PT-2023-13451 · Opentext · Opentext Imanager

CVE-2022-35898 · Publicado 2023-05-01 · Atualizado 2025-01-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenText BizManager versions prior to 16.6.0.1

Description The issue arises from improper validation during the change-password operation, allowing any authenticated user to change the password of any other user, including the Administrator account.

Recommendations For versions prior to 16.6.0.1, update to version 16.6.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the change-password operation to minimize the risk of exploitation.

Correção

Improper Authentication

Improper Certificate Validation

Enumeração de Fraquezas

CWE-287

CWE-295

Identificadores relacionados

CVE-2022-35898

Produtos afetados

Opentext Imanager

Referências · 6

• https://t.me/cibsecurity/63146 · Publicação no Telegram
• https://businessnetwork.opentext.com/b2b-gateway · Nota
• https://t.me/cvenotify/109217 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-35898 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-35898 · Aviso do Fabricante
• https://hackandpwn.com/disclosures/CVE-2022-35898.pdf · Nota