{
  "document": {
    "aggregate_severity": {
      "text": "HIGH"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0006.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0006.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0006.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2023-0006",
    "tracking": {
      "current_release_date": "2024-01-22T00:00:00+00:00",
      "generator": {
        "date": "2024-01-22T15:39:58+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2023-0006",
      "initial_release_date": "2023-09-25T00:00:00+02:00",
      "revision_history": [
        {
          "date": "2023-09-25T00:00:00+02:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "4",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "5",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "6",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "7",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "7"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev51",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev51",
                  "product_id": "OXAS-BACKEND_7.10.6-rev51",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev51:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.17",
                "product": {
                  "name": "OX App Suite backend 8.17",
                  "product_id": "OXAS-BACKEND_8.17",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.17:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev52",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev52",
                  "product_id": "OXAS-BACKEND_7.10.6-rev52",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev52:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6251"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.18",
                "product": {
                  "name": "OX App Suite backend 8.18",
                  "product_id": "OXAS-BACKEND_8.18",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.18:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev34",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev34",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev34",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev34:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev35",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev35",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev35",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev35:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6251"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite frontend"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-29051",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2023-09-21T00:08:33+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2315"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev52",
          "OXAS-BACKEND_8.18"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev51",
          "OXAS-BACKEND_8.17"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-24T21:10:11+02:00",
          "details": "Please deploy the provided updates and patch releases. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev51",
            "OXAS-BACKEND_8.17"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev51",
            "OXAS-BACKEND_8.17"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Unauthorized users could discover and modify application state, including objects related to other users and contexts."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "User-defined templates can bypass access control"
    },
    {
      "cve": "CVE-2023-29052",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-09-07T15:21:55+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2532"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev35"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev34"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-24T21:44:21+02:00",
          "details": "Please deploy the provided updates and patch releases. We added sanitization for this content.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev34"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev34"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS in upsell portal widget (shop disclaimer)"
    },
    {
      "cve": "CVE-2023-41710",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-09-07T15:27:19+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2533"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev35"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev34"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-24T21:44:04+02:00",
          "details": "Please deploy the provided updates and patch releases. We added sanitization for this content.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev34"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev34"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS in upsell portal widget (shop URL)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "HIGH"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "name": "Open-Xchange GmbH",
      "namespace": "https://open-xchange.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Release Notes",
        "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf"
      },
      {
        "category": "self",
        "summary": "Canonical CSAF document",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json"
      },
      {
        "category": "self",
        "summary": "Markdown representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/md/2023/oxas-adv-2023-0006.md"
      },
      {
        "category": "self",
        "summary": "HTML representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/html/2023/oxas-adv-2023-0006.html"
      },
      {
        "category": "self",
        "summary": "Plain-text representation",
        "url": "https://documentation.open-xchange.com/appsuite/security/advisories/txt/2023/oxas-adv-2023-0006.txt"
      }
    ],
    "title": "OX App Suite Security Advisory OXAS-ADV-2023-0006",
    "tracking": {
      "current_release_date": "2024-01-22T00:00:00+00:00",
      "generator": {
        "date": "2024-01-22T15:39:58+00:00",
        "engine": {
          "name": "OX CSAF",
          "version": "1.0.0"
        }
      },
      "id": "OXAS-ADV-2023-0006",
      "initial_release_date": "2023-09-25T00:00:00+02:00",
      "revision_history": [
        {
          "date": "2023-09-25T00:00:00+02:00",
          "number": "1",
          "summary": "Initial release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "2",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "3",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "4",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "5",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "6",
          "summary": "Public release"
        },
        {
          "date": "2024-01-22T00:00:00+00:00",
          "number": "7",
          "summary": "Public release"
        }
      ],
      "status": "final",
      "version": "7"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev51",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev51",
                  "product_id": "OXAS-BACKEND_7.10.6-rev51",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev51:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.17",
                "product": {
                  "name": "OX App Suite backend 8.17",
                  "product_id": "OXAS-BACKEND_8.17",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.17:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev52",
                "product": {
                  "name": "OX App Suite backend 7.10.6-rev52",
                  "product_id": "OXAS-BACKEND_7.10.6-rev52",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev52:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6251"
                      }
                    ]
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.18",
                "product": {
                  "name": "OX App Suite backend 8.18",
                  "product_id": "OXAS-BACKEND_8.18",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:8.18:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite backend"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.10.6-rev34",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev34",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev34",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev34:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "7.10.6-rev35",
                "product": {
                  "name": "OX App Suite frontend 7.10.6-rev35",
                  "product_id": "OXAS-FRONTEND_7.10.6-rev35",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:open-xchange:app_suite:7.10.6:rev35:*:*:*:*:*:*",
                    "x_generic_uris": [
                      {
                        "namespace": "https://documentation.open-xchange.com/appsuite/security/advisories/#urn-parsing",
                        "uri": "urn:open-xchange:app_suite:patch-id:6251"
                      }
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OX App Suite frontend"
          }
        ],
        "category": "vendor",
        "name": "Open-Xchange GmbH"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-29051",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2023-09-21T00:08:33+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "MWB-2315"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-BACKEND_7.10.6-rev52",
          "OXAS-BACKEND_8.18"
        ],
        "last_affected": [
          "OXAS-BACKEND_7.10.6-rev51",
          "OXAS-BACKEND_8.17"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-24T21:10:11+02:00",
          "details": "Please deploy the provided updates and patch releases. We now make sure that the switch to disable user-generated templates by default works as intended and will remove the feature in future generations of the product.",
          "product_ids": [
            "OXAS-BACKEND_7.10.6-rev51",
            "OXAS-BACKEND_8.17"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-BACKEND_7.10.6-rev51",
            "OXAS-BACKEND_8.17"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Unauthorized users could discover and modify application state, including objects related to other users and contexts."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "User-defined templates can bypass access control"
    },
    {
      "cve": "CVE-2023-29052",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-09-07T15:21:55+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2532"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev35"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev34"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-24T21:44:21+02:00",
          "details": "Please deploy the provided updates and patch releases. We added sanitization for this content.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev34"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev34"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS in upsell portal widget (shop disclaimer)"
    },
    {
      "cve": "CVE-2023-41710",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2023-09-07T15:27:19+02:00",
      "ids": [
        {
          "system_name": "OX Bug",
          "text": "OXUIB-2533"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "User-defined script code could be stored for a upsell related shop URL. This code was not correctly sanitized when adding it to DOM."
        }
      ],
      "product_status": {
        "first_fixed": [
          "OXAS-FRONTEND_7.10.6-rev35"
        ],
        "last_affected": [
          "OXAS-FRONTEND_7.10.6-rev34"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-09-24T21:44:04+02:00",
          "details": "Please deploy the provided updates and patch releases. We added sanitization for this content.",
          "product_ids": [
            "OXAS-FRONTEND_7.10.6-rev34"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "OXAS-FRONTEND_7.10.6-rev34"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain."
        },
        {
          "category": "exploit_status",
          "details": "No publicly available exploits are known."
        }
      ],
      "title": "XSS in upsell portal widget (shop URL)"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2023-29052",
    "id": "GSD-2023-29052"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-29052"
      ],
      "details": "Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.\n\n",
      "id": "GSD-2023-29052",
      "modified": "2023-12-13T01:20:56.647109Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@open-xchange.com",
        "ID": "CVE-2023-29052",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "OX App Suite",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "7.10.6-rev34"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Open-Xchange GmbH"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-79",
                "lang": "eng",
                "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf",
            "refsource": "MISC",
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf"
          },
          {
            "name": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json",
            "refsource": "MISC",
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json"
          }
        ]
      },
      "source": {
        "defect": "OXUIB-2532",
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:-:*:*:*:*:*:*",
                    "matchCriteriaId": "3A4EAD2E-C3C3-4C79-8C42-375FFE638486",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev01:*:*:*:*:*:*",
                    "matchCriteriaId": "39198733-D227-4935-9A60-1026040D262F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev02:*:*:*:*:*:*",
                    "matchCriteriaId": "3C86EE81-8CD4-4131-969A-BDA24B9B48E8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev03:*:*:*:*:*:*",
                    "matchCriteriaId": "F9E9C869-7DA9-4EFA-B613-82BA127F6CE5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev04:*:*:*:*:*:*",
                    "matchCriteriaId": "F8FAA329-5893-412B-8349-4DA3023CC76E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev05:*:*:*:*:*:*",
                    "matchCriteriaId": "BB6A57A4-B18D-498D-9A8C-406797A6255C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev06:*:*:*:*:*:*",
                    "matchCriteriaId": "7F0977F0-90B4-48B4-BED6-C218B5CA5E03",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev07:*:*:*:*:*:*",
                    "matchCriteriaId": "4D55DE67-8F93-48F3-BE54-D3A065479281",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev08:*:*:*:*:*:*",
                    "matchCriteriaId": "D27980B4-B71B-4DA8-B130-F0B5929F8E65",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev09:*:*:*:*:*:*",
                    "matchCriteriaId": "DD1709BC-7DEB-4508-B3C3-B20F5FD001A3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev10:*:*:*:*:*:*",
                    "matchCriteriaId": "08A6BDD5-259E-4DC3-A548-00CD0D459749",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev11:*:*:*:*:*:*",
                    "matchCriteriaId": "B8166FF4-77D8-4A12-92E5-615B3DA2E602",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev12:*:*:*:*:*:*",
                    "matchCriteriaId": "999F057B-7918-461A-B60C-3BE72E92CDC9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev13:*:*:*:*:*:*",
                    "matchCriteriaId": "88FD1550-3715-493E-B674-9ECF3DD7A813",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev14:*:*:*:*:*:*",
                    "matchCriteriaId": "F31A4949-397F-4D1B-8AEA-AC7B335722F8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev15:*:*:*:*:*:*",
                    "matchCriteriaId": "D33A91D4-CE21-486D-9469-B09060B8C637",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev16:*:*:*:*:*:*",
                    "matchCriteriaId": "5E3E5CD2-7631-4DBE-AB4D-669E82BCCAD4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev17:*:*:*:*:*:*",
                    "matchCriteriaId": "2BEE0AF0-3D22-4DE7-9E71-A4469D9CA2EB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev18:*:*:*:*:*:*",
                    "matchCriteriaId": "AAFB199C-1D66-442D-AD7E-414DD339E1D3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev19:*:*:*:*:*:*",
                    "matchCriteriaId": "26322561-2491-4DC7-B974-0B92B61A5BDA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev20:*:*:*:*:*:*",
                    "matchCriteriaId": "A6BA6C2B-F2D5-4FF7-B316-C8E99C2B464B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev21:*:*:*:*:*:*",
                    "matchCriteriaId": "733E4A65-821B-4187-AA3A-1ACD3E882C07",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev22:*:*:*:*:*:*",
                    "matchCriteriaId": "6B0A0043-33E8-4440-92AC-DDD70EA39535",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev23:*:*:*:*:*:*",
                    "matchCriteriaId": "303205CC-8BDE-47EE-A675-9BA19983139A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev24:*:*:*:*:*:*",
                    "matchCriteriaId": "8C088014-47D6-4632-9FB5-2C7B1085B762",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev25:*:*:*:*:*:*",
                    "matchCriteriaId": "42CF6057-EB40-4208-9F1E-83213E97987C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev26:*:*:*:*:*:*",
                    "matchCriteriaId": "966BC23E-B8CE-4F98-B3A6-4B620E8808BE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev27:*:*:*:*:*:*",
                    "matchCriteriaId": "7409CE19-ACC1-4AF4-8C8A-AE2CDBB63D3D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev28:*:*:*:*:*:*",
                    "matchCriteriaId": "17D71CDE-3111-459B-8520-F62E0D5D2972",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev29:*:*:*:*:*:*",
                    "matchCriteriaId": "6D808ED6-F819-4014-BD24-4537D52DDFB0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev30:*:*:*:*:*:*",
                    "matchCriteriaId": "B3792A91-10E9-42D9-B852-37D369D8364E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev31:*:*:*:*:*:*",
                    "matchCriteriaId": "6F0BFEEF-8B19-4F71-B7F1-2CC94969616F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev32:*:*:*:*:*:*",
                    "matchCriteriaId": "52003F06-9351-49B6-A3C5-A2B6FC0B9F4D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev33:*:*:*:*:*:*",
                    "matchCriteriaId": "C8786112-32AE-4BA5-8D66-D4E2429D3228",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:open-xchange:ox_app_suite:7.10.6:rev34:*:*:*:*:*:*",
                    "matchCriteriaId": "3A67F528-0248-4E24-A5AB-2995ED7D2600",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known."
          },
          {
            "lang": "es",
            "value": "Los usuarios pudieron definir textos de exenci\u00f3n de responsabilidad para un cuadro de di\u00e1logo de tienda de ventas adicionales que contendr\u00eda c\u00f3digo de script que no se sanitiz\u00f3 correctamente. Los atacantes podr\u00edan atraer a las v\u00edctimas a cuentas de usuario con c\u00f3digo de script malicioso y obligarlas a ejecutarlo en el contexto de un dominio confiable. Agregamos sanitizaci\u00f3n para este contenido. No se conocen exploits disponibles p\u00fablicamente."
          }
        ],
        "id": "CVE-2023-29052",
        "lastModified": "2024-01-22T11:15:47.380",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 2.7,
              "source": "security@open-xchange.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-01-08T09:15:20.680",
        "references": [
          {
            "source": "security@open-xchange.com",
            "tags": [
              "Issue Tracking"
            ],
            "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json"
          },
          {
            "source": "security@open-xchange.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf"
          }
        ],
        "sourceIdentifier": "security@open-xchange.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security@open-xchange.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-29052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-08T09:15:20Z",
    "severity": "MODERATE"
  },
  "details": "Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attackers could lure victims to user accounts with malicious script code and make them execute it in the context of a trusted domain. We added sanitization for this content. No publicly available exploits are known.\n\n",
  "id": "GHSA-xr84-qwr9-vj33",
  "modified": "2024-01-08T09:30:35Z",
  "published": "2024-01-08T09:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29052"
    },
    {
      "type": "WEB",
      "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0006.json"
    },
    {
      "type": "WEB",
      "url": "https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0006.json"
    },
    {
      "type": "WEB",
      "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6251_7.10.6_2023-09-25.pdf"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/176422/OX-App-Suite-7.10.6-Access-Control-Cross-Site-Scripting.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jan/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}