PT-2023-14797 · Opentext · Opentext Content Suite Platform

Armin Stock · Publicado 2023-01-18 · Atualizado 2023-01-26 · CVE-2022-45924

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenText Content Suite Platform version 16.2.19.1803

Description An issue was discovered that allows a low-privilege user to delete arbitrary files on the server's local filesystem through the "itemtemplate.createtemplate2" endpoint.

Recommendations For OpenText Content Suite Platform version 16.2.19.1803, consider restricting access to the "itemtemplate.createtemplate2" endpoint to prevent low-privilege users from deleting arbitrary files on the server's local filesystem.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2022-45924

Produtos afetados

Opentext Content Suite Platform

Referências · 8

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/multiple-post-authentication-vulnerabilities-including-rce-opentexttm-extended-ecm · Exploit
• 🔥 http://packetstormsecurity.com/files/170615/OpenText-Extended-ECM-22.3-File-Deletion-LFI-Privilege-Escsalation.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2023/Jan/14 · Exploit
• https://t.me/true_secator/3971 · Publicação no Telegram
• https://t.me/cvenotify/42351 · Publicação no Telegram
• https://t.me/cvenotify/42372 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45924 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-45924 · Aviso do Fabricante