CVE-2023-29032

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An attacker that has gained access to certain private information can use this to act as other user.

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
May 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-29047.3The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the applCVE-2023-290436.1Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed wCVE-2023-290445.4Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operationCVE-2023-290455.4Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could beCVE-2023-290464.3Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connectioCVE-2023-290477.3Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrarCVE-2023-290488.8A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runCVE-2023-290496.1The "upsell" widget at the portal page could be abused to inject arbitrary script code. Attackers that manage to lure users to a compromisedCVE-2023-29058.8Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an CVE-2023-290509.6The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outsideCVE-2023-290518.1User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable theCVE-2023-290525.4Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. Attack
CVE-2023-29032: High severity, CVSS 8.1 | Vulnix