CVE-2023-29052: XSS
Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-29052?
CVE-2023-29052 is rated as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2023-29052?
To remediate CVE-2023-29052, update to a patched version of the Open-Xchange OX App Suite, specifically version 7.10.6-rev35 or later.
What are the implications of CVE-2023-29052?
CVE-2023-29052 allows attackers to execute malicious scripts in the context of a trusted domain, which could lead to unauthorized actions on user accounts.
Which versions of Open-Xchange OX App Suite are affected by CVE-2023-29052?
CVE-2023-29052 affects all revisions of Open-Xchange OX App Suite version 7.10.6, including rev01 through rev34.
Is there a way to prevent exploitation of CVE-2023-29052 if I cannot update immediately?
While updating is the best solution, implementing input validation and sanitization can help mitigate the risk associated with CVE-2023-29052 until an update is applied.