CVE-2023-29052 — Cross-site Scripting in Gmbh OX APP Suite

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 51.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Open-xchange Gmbh OX APP SuiteOpen-xchange OX APP Suite
Timeline
PublishedJan 8

Description

Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5open-xchange_gmbh/ox_app_suite7.10.6-rev34

🔴Vulnerability Details

2
GHSA
GHSA-xr84-qwr9-vj33: Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly↗2024-01-08
▶
CVEList
CVE-2023-29052: Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly↗2024-01-08
▶
CVE-2023-29052 — Cross-site Scripting | cvebase