Lucene search

[email protected]NVD:CVE-2023-29045

HistoryNov 02, 2023 - 2:15 p.m.

CVE-2023-29045

2023-11-0214:15:11

CWE-79

[email protected]

web.nvd.nist.gov

data manipulation

script code

user collaboration

code execution

exploits

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

18.2%

JSON

Documents operations, in this case “drawing”, could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now gets checked for validity to avoid code execution. No publicly available exploits are known.

Affected configurations

NVD

Node

open-xchangeopen-xchange_appsuiteRange<7.10.6

open-xchangeopen-xchange_appsuiteMatch7.10.6-

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6069

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6073

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6080

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6085

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6093

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6102

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6112

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6121

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6133

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6138

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6141

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6146

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6147

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6148

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6150

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6156

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6161

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6166

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6173

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6176

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6178

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6189

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6194

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6199

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6204

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6205

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6209

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6210

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6214

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6215

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6216

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6218

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6219

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6220

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6227

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6230

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6233

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6235

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6236

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6239

open-xchangeopen-xchange_appsuiteMatch7.10.6patch_release_6241

References

documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0004.json

software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6243_7.10.6_2023-08-01.pdf