PT-2025-17436 · Opentext · Opentext Content Server

Hussein Bahmad · Published 2025-04-21 · Updated 2025-04-21 · CVE-2024-12862

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions OpenText Content Server versions 20.2 through 24.4

Description The issue is related to an Incorrect Authorization vulnerability in the OpenText Content Server REST API, allowing users without the appropriate permissions to remove external collaborators.

Recommendations For versions 20.2 through 24.4, consider restricting access to the REST API until a patch is available. As a temporary workaround, limit the ability of users to remove external collaborators to minimize the risk of exploitation. Avoid using the API for collaborator management until the issue is resolved.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-12862

Affected Products

Opentext Content Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-12862 · Security Note
• https://t.me/cvedetector/23445 · Telegram Post
• https://t.me/cvetracker/22048 · Telegram Post
• https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0839115 · Note
• https://twitter.com/CVEnew/status/1914330928370889032 · Twitter Post
• https://twitter.com/cybercronai/status/1914329678346600520 · Twitter Post
• https://twitter.com/cybercronai/status/1914337339813359672 · Twitter Post