Vulnerability Description
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java application server can be used to bypass the authentication of the QDS endpoints of the Content Server. These endpoints can be used to create objects and execute arbitrary code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opentext | Opentext Extended Ecm | >= 20.4, < 22.4 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/170614/OpenText-Extended-ECM-22.3-Java-FronExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2023/Jan/13ExploitMailing ListThird Party Advisory
- https://sec-consult.com/vulnerability-lab/advisory/pre-authenticated-remote-codeExploitThird Party Advisory
- http://packetstormsecurity.com/files/170614/OpenText-Extended-ECM-22.3-Java-FronExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2023/Jan/13ExploitMailing ListThird Party Advisory
- https://sec-consult.com/vulnerability-lab/advisory/pre-authenticated-remote-codeExploitThird Party Advisory
FAQ
What is CVE-2022-45927?
CVE-2022-45927 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java application server can be used to bypass the authentication of the QDS endpoints of the Content Server. These e...
How severe is CVE-2022-45927?
CVE-2022-45927 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-45927?
Check the references section above for vendor advisories and patch information. Affected products include: Opentext Opentext Extended Ecm.