PT-2024-16644 · Opentext · Opentext Alm Octane Management

Published 2024-11-12 · Updated 2024-11-13 · CVE-2024-10923

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:N/AU:N/R:A/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions OpenText ALM Octane Management versions 16.2.100 through 24.4

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Stored XSS. This could result in a remote code execution attack.

Recommendations For versions 16.2.100 through 24.4, update to a version that contains a fix for this issue to prevent remote code execution attacks. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10923

Affected Products

Opentext Alm Octane Management

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-10923 · Security Note
• https://t.me/cvenotify/101607 · Telegram Post
• https://portal.microfocus.com/s/article/KM000036146?language=en_US · Note
• https://twitter.com/CVEnew/status/1856385108464546309 · Twitter Post