CVE-2023-29049

The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known.

• CWE-79
• CWE-79

• http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2024/Jan/3Mailing List, Third Party Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.jsonIssue Tracking
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdfRelease Notes
• http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2024/Jan/3Mailing List, Third Party Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.jsonIssue Tracking
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdfRelease Notes

Published

Jan 8, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29043Presentations may contain references to images, which are us…6.1
• CVE-2023-29044Documents operations could be manipulated to contain invalid…5.4
• CVE-2023-29045Documents operations, in this case "drawing", could be manip…5.4
• CVE-2023-29046Connections to external data sources, like e-mail autoconfig…4.3
• CVE-2023-29047Imageconverter API endpoints provided methods that were not …7.3
• CVE-2023-29048A component for parsing OXMF templates could be abused to ex…8.8
• CVE-2023-2905Due to a failure in validating the length of a provided MQTT…8.8
• CVE-2023-29050The optional "LDAP contacts provider" could be abused by pri…9.6
• CVE-2023-29051User-defined OXMF templates could be used to access a limite…8.1
• CVE-2023-29052Users were able to define disclaimer texts for an upsell sho…5.4
• CVE-2023-29053A vulnerability has been identified in JT Open (All versions…7.8
• CVE-2023-29054A vulnerability has been identified in SCALANCE X200-4P IRT …7.4