PT-2023-22109 · Ox Software Gmbh+1 · Ox App Suite+2

Published 2023-11-02 · Updated 2024-01-12 · CVE-2023-29045

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description Documents operations, specifically "drawing", could be manipulated to contain invalid data types, possibly script code. This script code could be injected into an operation that would be executed for users actively collaborating on the same document. To avoid code execution, operation data exchanged between collaborating parties is now checked for validity. No publicly available exploits are known.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-29045

Affected Products

Ox App Suite

Open-Xchange

Open-Xchange Appsuite

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-29045 · Security Note
• https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf · Vendor Advisory
• https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29045 · Vendor Advisory
• https://t.me/cibsecurity/73455 · Telegram Post
• https://t.me/cvenotify/67169 · Telegram Post
• https://twitter.com/CVEnew/status/1720068048340840815 · Twitter Post