Lucene search

[email protected]CVE-2023-4554

HistoryJan 29, 2024 - 9:15 p.m.

CVE-2023-4554

2024-01-2921:15:09

CWE-611

[email protected]

web.nvd.nist.gov

cve-2023-4554

xxe

vulnerability

opentext appbuilder

server side request forgery

ssrf

nvd

security issue

xml

appbuilder from 21.2 to 23.2

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.2%

JSON

Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files.

AppBuilder’s XML processor is vulnerable to XML External Entity Processing (XXE), allowing an authenticated user to upload specially crafted XML files to induce server-side request forgery, disclose files local to the server that processes them.

This issue affects AppBuilder: from 21.2 before 23.2.

Affected configurations

NVD

Node

opentextappbuilderRange21.2–23.2

AND

linuxlinux_kernelMatch-

microsoftwindowsMatch-

CPENameOperatorVersion
opentext:appbuilderopentext appbuilderlt23.2

CPE	Name	Operator	Version
opentext:appbuilder	opentext appbuilder	lt	23.2

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "Linux"
    ],
    "product": "AppBuilder",
    "vendor": "OpenText",
    "versions": [
      {
        "status": "unaffected",
        "version": "23.2"
      },
      {
        "lessThan": "23.2",
        "status": "affected",
        "version": "21.2",
        "versionType": "custom"
      }
    ]
  }
]

References

support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.2%

JSON

Related for CVE-2023-4554

nvd1 prion1 cvelist1