{"id":"CVE-2023-29052","details":"Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.","modified":"2026-08-12T03:51:41.702410784Z","published":"2024-01-08T09:04:35.617Z","database_specific":{"cna_assigner":"OX","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29052.json","unresolved_ranges":[{"extracted_events":[{"last_affected":"7.10.6-rev34"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"http://seclists.org/fulldisclosure/2024/Jan/4"},{"type":"ADVISORY","url":"https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29052.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29052"},{"type":"ADVISORY","url":"https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-xchange/appsuite-frontend","events":[{"introduced":"489e7d0bf2bb0dc4c984860c4ce6f4d772086875"},{"last_affected":"722628ce97f9626245edc01f07e7f0b7afb12ae5"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:*","cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.10.6-NA"},{"last_affected":"7.10.6-NA"},{"introduced":"7.10.6-rev10"},{"last_affected":"7.10.6-rev10"},{"introduced":"7.10.6-rev11"},{"last_affected":"7.10.6-rev11"},{"introduced":"7.10.6-rev12"},{"last_affected":"7.10.6-rev12"},{"introduced":"7.10.6-rev13"},{"last_affected":"7.10.6-rev13"},{"introduced":"7.10.6-rev14"},{"last_affected":"7.10.6-rev14"},{"introduced":"7.10.6-rev15"},{"last_affected":"7.10.6-rev15"},{"introduced":"7.10.6-rev16"},{"last_affected":"7.10.6-rev16"},{"introduced":"7.10.6-rev17"},{"last_affected":"7.10.6-rev17"},{"introduced":"7.10.6-rev18"},{"last_affected":"7.10.6-rev18"},{"introduced":"7.10.6-rev19"},{"last_affected":"7.10.6-rev19"},{"introduced":"7.10.6-rev20"},{"last_affected":"7.10.6-rev20"},{"introduced":"7.10.6-rev21"},{"last_affected":"7.10.6-rev21"},{"introduced":"7.10.6-rev22"},{"last_affected":"7.10.6-rev22"},{"introduced":"7.10.6-rev23"},{"last_affected":"7.10.6-rev23"},{"introduced":"7.10.6-rev24"},{"last_affected":"7.10.6-rev24"},{"introduced":"7.10.6-rev25"},{"last_affected":"7.10.6-rev25"},{"introduced":"7.10.6-rev26"},{"last_affected":"7.10.6-rev26"},{"introduced":"7.10.6-rev27"},{"last_affected":"7.10.6-rev27"},{"introduced":"7.10.6-rev28"},{"last_affected":"7.10.6-rev28"},{"introduced":"7.10.6-rev29"},{"last_affected":"7.10.6-rev29"},{"introduced":"7.10.6-rev30"},{"last_affected":"7.10.6-rev30"},{"introduced":"7.10.6-rev31"},{"last_affected":"7.10.6-rev31"},{"introduced":"7.10.6-rev32"},{"last_affected":"7.10.6-rev32"},{"introduced":"7.10.6-rev33"},{"last_affected":"7.10.6-rev33"},{"introduced":"7.10.6-rev34"},{"last_affected":"7.10.6-rev34"}]}}],"versions":["7.10.6-NA","7.10.6-rev10","7.10.6-rev11","7.10.6-rev12","7.10.6-rev13","7.10.6-rev14","7.10.6-rev15","7.10.6-rev16","7.10.6-rev17","7.10.6-rev18","7.10.6-rev19","7.10.6-rev20","7.10.6-rev21","7.10.6-rev22","7.10.6-rev23","7.10.6-rev24","7.10.6-rev25","7.10.6-rev26","7.10.6-rev27","7.10.6-rev28","7.10.6-rev29","7.10.6-rev30","7.10.6-rev31","7.10.6-rev32","7.10.6-rev33","7.10.6-rev34"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-29052.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}