CVE-2023-29050

The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.

• CWE-90
• CWE-74

• http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2024/Jan/3Mailing List, Third Party Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.jsonIssue Tracking
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdfRelease Notes
• http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2024/Jan/3Mailing List, Third Party Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.jsonIssue Tracking
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdfRelease Notes

Published

Jan 8, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29045Documents operations, in this case "drawing", could be manip…5.4
• CVE-2023-29046Connections to external data sources, like e-mail autoconfig…4.3
• CVE-2023-29047Imageconverter API endpoints provided methods that were not …7.3
• CVE-2023-29048A component for parsing OXMF templates could be abused to ex…8.8
• CVE-2023-29049The "upsell" widget at the portal page could be abused to in…6.1
• CVE-2023-2905Due to a failure in validating the length of a provided MQTT…8.8
• CVE-2023-29051User-defined OXMF templates could be used to access a limite…8.1
• CVE-2023-29052Users were able to define disclaimer texts for an upsell sho…5.4
• CVE-2023-29053A vulnerability has been identified in JT Open (All versions…7.8
• CVE-2023-29054A vulnerability has been identified in SCALANCE X200-4P IRT …7.4
• CVE-2023-29055In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Co…7.5
• CVE-2023-29056A valid LDAP user, under specific conditions, will default t…5.9