PT-2023-13451 · Opentext · Opentext Imanager

Published 2023-05-01 · Updated 2025-01-30 · CVE-2022-35898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenText BizManager versions prior to 16.6.0.1

Description The issue arises from improper validation during the change-password operation, allowing any authenticated user to change the password of any other user, including the Administrator account.

Recommendations For versions prior to 16.6.0.1, update to version 16.6.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the change-password operation to minimize the risk of exploitation.

Fix

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

CVE-2022-35898

Affected Products

Opentext Imanager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-35898 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35898 · Vendor Advisory
• https://t.me/cibsecurity/63146 · Telegram Post
• https://businessnetwork.opentext.com/b2b-gateway · Note
• https://t.me/cvenotify/109217 · Telegram Post
• https://hackandpwn.com/disclosures/CVE-2022-35898.pdf · Note