CVE-2023-29048: open-xchange gmbh ox app suite OS Command Injection

Vulnerability summary

CVE-2023-29048 is a high (CVSS 8.8) OS Command Injection vulnerability in open-xchange gmbh ox app suite. EPSS estimates a 1.33% chance of exploitation in the next 30 days, higher than 70.7% of scored vulnerabilities.

Timeline

1. 08-01-2024
   PublishedVulnerability first disclosed.
2. 06-06-2025
   Last modifiedVulnerability information updated.

Description

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.