Description
The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Open-Xchange GmbH | OX App Suite | unaffected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-32653 | The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromised account, or gain temporary access to a legitimate account, could inject script code to gain persistent code execution capabilities under a trusted domain. User input for this widget is now sanitized to avoid malicious content the be processed. No publicly available exploits are known. |
References
History
Thu, 17 Apr 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: OX
Published:
Updated: 2025-04-17T18:09:04.675Z
Reserved: 2023-03-30T09:34:25.189Z
Link: CVE-2023-29049
Vulnrichment
Updated: 2024-08-02T14:00:14.708Z
NVD
Status : Modified
Published: 2024-01-08T09:15:20.120
Modified: 2024-11-21T07:56:26.957
Link: CVE-2023-29049
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses