CVE-2023-29048 Command injection in OX App Suite
Attackers can execute arbitrary system commands via OXMF templates, leading to unauthorized data access and modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29048?
CVE-2023-29048 is a high-severity command injection vulnerability in Open-Xchange GmbH OX App Suite, published on 8 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially violate integrity by modifying resources. The template engine has been reconfigured to deny execution of harmful commands on a system level. No publicly available exploits are known.
Weakness: CWE-78
Which versions are affected by CVE-2023-29048?
It affects 1 product.
Products include Open-Xchange Ox App Suite.
How do I fix CVE-2023-29048?
No fix has been published for CVE-2023-29048 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-29048 being exploited?
There is no known exploitation of CVE-2023-29048 in the wild and no public exploit code.
Other vulnerabilities in Open-Xchange GmbH OX App Suite
Sources
Also known as GHSA-2w87-fjj9-j39h.