CVE-2023-4501 — CRITICAL (9.8)

Vulnerability Description

User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user. Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon. Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Microfocus	Cobol Server	7.0
Microfocus	Enterprise Developer	7.0
Microfocus	Enterprise Server	7.0
Microfocus	Enterprise Test Server	7.0
Microfocus	Visual Cobol	7.0

Related Weaknesses (CWE)

CWE-305 CWE-287 CWE-253 CWE-358

References

https://portal.microfocus.com/s/article/KM000021287Vendor Advisory
https://portal.microfocus.com/s/article/KM000021287Vendor Advisory

FAQ

What is CVE-2023-4501?

CVE-2023-4501 is a vulnerability with a CVSS score of 9.8 (CRITICAL). User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants ...

How severe is CVE-2023-4501?

CVE-2023-4501 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2023-4501?

Check the references section above for vendor advisories and patch information. Affected products include: Microfocus Cobol Server, Microfocus Enterprise Developer, Microfocus Enterprise Server, Microfocus Enterprise Test Server, Microfocus Visual Cobol.