Arbitrary Command Execution Vulnerability in Open-Xchange OX App Suite

CVE-2023-29048

What is CVE-2023-29048?

The vulnerability arises from a flaw in the OXMF template parsing component, which could be exploited to execute arbitrary system commands as a non-privileged runtime user. This weakness may allow both users and attackers to gain unauthorized access to sensitive information and compromise the integrity of system resources. In light of this discovery, measures have been implemented to reconfigure the template engine to prevent the execution of harmful commands at the system level. Currently, there are no publicly known exploits for this vulnerability.

References