CVE-2022-45927

An issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. The Java application server can be used to bypass the authentication of the QDS endpoints of the Content Server. These endpoints can be used to create objects and execute arbitrary code...

CVE-2022-45924

CVE-2022-45924 affects OpenText Content Suite Platform 22.1 (16.2.19.1803). The vulnerability is in the endpoint itemtemplate.createtemplate2 which allows a low-privilege user to delete arbitrary files on the server’s local filesystem. Impact is described as high (I/H, A/H, CVSS 3.1: 8.1). A fixe...

CVE-2022-45928

OpenText Content Suite Platform 22.1 (16.2.19.1803) is affected by a remote OScript execution vulnerability. Multiple endpoints accept the htmlFile parameter, which is processed in the HTML rendering pipeline and can trigger Oscript code execution in the Content Server. The underlying risk is tha...

CVE-2022-45927

OpenText Content Suite Platform 22.1 (16.2.19.1803) contains a flaw in the Java application server that can bypass authentication for the Content Server QDS endpoints, allowing creation of objects and arbitrary code execution. The issue is described as pre-auth remote code execution with high imp...

CVE-2022-45925

CVE-2022-45925 affects OpenText Content Suite Platform 22.1 (16.2.19.1803). The vulnerability arises in the action xmlexport when the parameter requestContext is present; the response may disclose most HTTP headers and certain CGI variables (e.g., remote_adde, server_name), constituting an inform...

CVE-2022-45922

OpenText Content Suite Platform 22.1 (16.2.19.1803) contains a post-authentication flaw in the ll.KeepAliveSession request handler. It sets a valid AdminPwd cookie even when the Web Admin password was not entered, allowing access to endpoints that require AdminPwd without knowing the password. CV...