CVE-2023-29048: OS Command Injection
First published: Mon Jan 08 2024(Updated: )
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
Credit: security@open-xchange.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Open-Xchange App Suite Backend | <7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6 | |
| Open-Xchange App Suite Backend | =7.10.6-rev01 | |
| Open-Xchange App Suite Backend | =7.10.6-rev02 | |
| Open-Xchange App Suite Backend | =7.10.6-rev03 | |
| Open-Xchange App Suite Backend | =7.10.6-rev04 | |
| Open-Xchange App Suite Backend | =7.10.6-rev05 | |
| Open-Xchange App Suite Backend | =7.10.6-rev06 | |
| Open-Xchange App Suite Backend | =7.10.6-rev07 | |
| Open-Xchange App Suite Backend | =7.10.6-rev08 | |
| Open-Xchange App Suite Backend | =7.10.6-rev09 | |
| Open-Xchange App Suite Backend | =7.10.6-rev10 | |
| Open-Xchange App Suite Backend | =7.10.6-rev11 | |
| Open-Xchange App Suite Backend | =7.10.6-rev12 | |
| Open-Xchange App Suite Backend | =7.10.6-rev13 | |
| Open-Xchange App Suite Backend | =7.10.6-rev14 | |
| Open-Xchange App Suite Backend | =7.10.6-rev15 | |
| Open-Xchange App Suite Backend | =7.10.6-rev16 | |
| Open-Xchange App Suite Backend | =7.10.6-rev17 | |
| Open-Xchange App Suite Backend | =7.10.6-rev18 | |
| Open-Xchange App Suite Backend | =7.10.6-rev19 | |
| Open-Xchange App Suite Backend | =7.10.6-rev20 | |
| Open-Xchange App Suite Backend | =7.10.6-rev21 | |
| Open-Xchange App Suite Backend | =7.10.6-rev22 | |
| Open-Xchange App Suite Backend | =7.10.6-rev23 | |
| Open-Xchange App Suite Backend | =7.10.6-rev24 | |
| Open-Xchange App Suite Backend | =7.10.6-rev25 | |
| Open-Xchange App Suite Backend | =7.10.6-rev26 | |
| Open-Xchange App Suite Backend | =7.10.6-rev27 | |
| Open-Xchange App Suite Backend | =7.10.6-rev28 | |
| Open-Xchange App Suite Backend | =7.10.6-rev29 | |
| Open-Xchange App Suite Backend | =7.10.6-rev30 | |
| Open-Xchange App Suite Backend | =7.10.6-rev31 | |
| Open-Xchange App Suite Backend | =7.10.6-rev32 | |
| Open-Xchange App Suite Backend | =7.10.6-rev33 | |
| Open-Xchange App Suite Backend | =7.10.6-rev34 | |
| Open-Xchange App Suite Backend | =7.10.6-rev35 | |
| Open-Xchange App Suite Backend | =7.10.6-rev36 | |
| Open-Xchange App Suite Backend | =7.10.6-rev37 | |
| Open-Xchange App Suite Backend | =7.10.6-rev50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf
- https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json
- http://seclists.org/fulldisclosure/2024/Jan/3
- http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html
Frequently Asked Questions
What is the severity of CVE-2023-29048?
CVE-2023-29048 is classified as a medium severity vulnerability.
How do I fix CVE-2023-29048?
To mitigate CVE-2023-29048, update to a patched version of the Open-Xchange OX App Suite, specifically version 7.10.6 or later.
What are the consequences of CVE-2023-29048 exploitation?
Exploitation of CVE-2023-29048 allows attackers to execute arbitrary system commands, potentially leading to unauthorized access to sensitive information.
Which versions of Open-Xchange OX App Suite are affected by CVE-2023-29048?
CVE-2023-29048 affects Open-Xchange OX App Suite versions prior to 7.10.6.
Is there any workaround for CVE-2023-29048?
There are no known effective workarounds for CVE-2023-29048 other than applying the recommended updates.
- agent/type
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/open-xchange
- canonical/open-xchange app suite backend
- version/open-xchange app suite backend/7.10.6
- version/open-xchange app suite backend/7.10.6-rev01
- version/open-xchange app suite backend/7.10.6-rev02
- version/open-xchange app suite backend/7.10.6-rev03
- version/open-xchange app suite backend/7.10.6-rev04
- version/open-xchange app suite backend/7.10.6-rev05
- version/open-xchange app suite backend/7.10.6-rev06
- version/open-xchange app suite backend/7.10.6-rev07
- version/open-xchange app suite backend/7.10.6-rev08
- version/open-xchange app suite backend/7.10.6-rev09
- version/open-xchange app suite backend/7.10.6-rev10
- version/open-xchange app suite backend/7.10.6-rev11
- version/open-xchange app suite backend/7.10.6-rev12
- version/open-xchange app suite backend/7.10.6-rev13
- version/open-xchange app suite backend/7.10.6-rev14
- version/open-xchange app suite backend/7.10.6-rev15
- version/open-xchange app suite backend/7.10.6-rev16
- version/open-xchange app suite backend/7.10.6-rev17
- version/open-xchange app suite backend/7.10.6-rev18
- version/open-xchange app suite backend/7.10.6-rev19
- version/open-xchange app suite backend/7.10.6-rev20
- version/open-xchange app suite backend/7.10.6-rev21
- version/open-xchange app suite backend/7.10.6-rev22
- version/open-xchange app suite backend/7.10.6-rev23
- version/open-xchange app suite backend/7.10.6-rev24
- version/open-xchange app suite backend/7.10.6-rev25
- version/open-xchange app suite backend/7.10.6-rev26
- version/open-xchange app suite backend/7.10.6-rev27
- version/open-xchange app suite backend/7.10.6-rev28
- version/open-xchange app suite backend/7.10.6-rev29
- version/open-xchange app suite backend/7.10.6-rev30
- version/open-xchange app suite backend/7.10.6-rev31
- version/open-xchange app suite backend/7.10.6-rev32
- version/open-xchange app suite backend/7.10.6-rev33
- version/open-xchange app suite backend/7.10.6-rev34
- version/open-xchange app suite backend/7.10.6-rev35
- version/open-xchange app suite backend/7.10.6-rev36
- version/open-xchange app suite backend/7.10.6-rev37
- version/open-xchange app suite backend/7.10.6-rev50