{"id":"CVE-2023-29048","details":"A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.\n\n","modified":"2026-10-28T02:30:20.922572120Z","published":"2024-01-08T08:51:31.461Z","database_specific":{"cna_assigner":"OX","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29048.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"last_affected":"7.10.6-rev50"}]}]}]},"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2024/Jan/3"},{"type":"ADVISORY","url":"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29048.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29048"},{"type":"ADVISORY","url":"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-xchange/appsuite-frontend","events":[{"introduced":"0"},{"fixed":"489e7d0bf2bb0dc4c984860c4ce6f4d772086875"},{"introduced":"489e7d0bf2bb0dc4c984860c4ce6f4d772086875"},{"last_affected":"8552612bd1f09c300884661303a0ec515f7d3bd5"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"7.10.6"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:*:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*","range":[{"introduced":"7.10.6-NA"},{"last_affected":"7.10.6-NA"}]},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev10"},{"last_affected":"7.10.6-rev10"}],"source":"CPE_STRING"},{"range":[{"introduced":"7.10.6-rev11"},{"last_affected":"7.10.6-rev11"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*"},{"range":[{"introduced":"7.10.6-rev12"},{"last_affected":"7.10.6-rev12"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev13"},{"last_affected":"7.10.6-rev13"}]},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev14"},{"last_affected":"7.10.6-rev14"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev15"},{"last_affected":"7.10.6-rev15"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev16"},{"last_affected":"7.10.6-rev16"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev17"},{"last_affected":"7.10.6-rev17"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev18"},{"last_affected":"7.10.6-rev18"}]},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev19"},{"last_affected":"7.10.6-rev19"}],"source":"CPE_STRING"},{"range":[{"introduced":"7.10.6-rev20"},{"last_affected":"7.10.6-rev20"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev21"},{"last_affected":"7.10.6-rev21"}]},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev22"},{"last_affected":"7.10.6-rev22"}],"source":"CPE_STRING"},{"range":[{"introduced":"7.10.6-rev23"},{"last_affected":"7.10.6-rev23"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*"},{"range":[{"introduced":"7.10.6-rev24"},{"last_affected":"7.10.6-rev24"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev25"},{"last_affected":"7.10.6-rev25"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev26"},{"last_affected":"7.10.6-rev26"}]},{"range":[{"introduced":"7.10.6-rev27"},{"last_affected":"7.10.6-rev27"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev28"},{"last_affected":"7.10.6-rev28"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev29"},{"last_affected":"7.10.6-rev29"}],"source":"CPE_STRING"},{"range":[{"introduced":"7.10.6-rev30"},{"last_affected":"7.10.6-rev30"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev31"},{"last_affected":"7.10.6-rev31"}]},{"range":[{"introduced":"7.10.6-rev32"},{"last_affected":"7.10.6-rev32"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev33"},{"last_affected":"7.10.6-rev33"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev34"},{"last_affected":"7.10.6-rev34"}]},{"range":[{"introduced":"7.10.6-rev35"},{"last_affected":"7.10.6-rev35"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev35:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev36:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev36"},{"last_affected":"7.10.6-rev36"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev37:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev37"},{"last_affected":"7.10.6-rev37"}]},{"cpe":"cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev50:*:*:*:*:*:*","range":[{"introduced":"7.10.6-rev50"},{"last_affected":"7.10.6-rev50"}],"source":"CPE_STRING"}]}}],"versions":["7.10.6-NA","7.10.6-rev10","7.10.6-rev11","7.10.6-rev12","7.10.6-rev13","7.10.6-rev14","7.10.6-rev15","7.10.6-rev16","7.10.6-rev17","7.10.6-rev18","7.10.6-rev19","7.10.6-rev20","7.10.6-rev21","7.10.6-rev22","7.10.6-rev23","7.10.6-rev24","7.10.6-rev25","7.10.6-rev26","7.10.6-rev27","7.10.6-rev28","7.10.6-rev29","7.10.6-rev30","7.10.6-rev31","7.10.6-rev32","7.10.6-rev33","7.10.6-rev34","7.10.6-rev35","7.10.6-rev36","7.10.6-rev37","7.10.6-rev50","7.10.6-50","7.10.6-21","as-next","7.10.5-2","7.10.5-1","7.10.5-0","7.10.4-1","7.10.4-0","7.10.3-0","7.10.0-2","7.10.0-0","7.8.3-10","7.8.3-9","7.8.2-16","7.8.2-14","7.8.2-9","7.8.2-7","7.8.2-6","7.8.2-5","7.8.1-14","7.8.1-11","7.8.1-10","7.8.0-19","7.8.0-12","7.8.0-11","7.8.0-10","7.8.0-8","7.8.0-7","7.6.2-24","7.6.2-23","7.6.2-22","7.6.2-19","7.6.2-18","7.6.2-16","7.6.2-13","7.4.1-6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29048.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}