PT-2025-3697 · Opentext · Opentext Content Management

Published 2025-02-04 · Updated 2025-02-04 · CVE-2024-8125

Positive Technologies (AI Summary)

CVSS v4.0

5.4

Medium

Base vector

AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:N/R:U/V:C/RE:H/U:Amber

Name of the Vulnerable Software and Affected Versions OpenText Content Management (Extended ECM) versions 10.0 through 24.4

Description The issue is related to improper validation of specified input types, allowing parameter injection. An actor with necessary privileges could exploit this to carry out a remote code execution attack on the target system. This issue affects systems with the WebReports module installed and enabled.

Recommendations For versions 10.0 through 24.4, consider disabling the WebReports module until a patch is available to prevent exploitation. Restrict access to the system to minimize the risk of remote code execution attacks.

Fix

Weakness Enumeration

CWE-1287

Related Identifiers

CVE-2024-8125

Affected Products

Opentext Content Management

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-8125 · Security Note
• https://t.me/cvedetector/17242 · Telegram Post
• https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0834058 · Note
• https://twitter.com/CVEnew/status/1886891652012499290 · Twitter Post