CVE-2022-45925

Опубликовано: 18 янв. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The action xmlexport accepts the parameter requestContext. If this parameter is present, the response includes most of the HTTP headers sent to the server and some of the CGI variables like remote_adde and server_name, which is an information disclosure.

Ссылки

http://packetstormsecurity.com/files/170615/OpenText-Extended-ECM-22.3-File-Deletion-LFI-Privilege-Escsalation.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2023/Jan/14
Exploit
Mailing List
Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/multiple-post-authentication-vulnerabilities-including-rce-opentexttm-extended-ecm/
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/170615/OpenText-Extended-ECM-22.3-File-Deletion-LFI-Privilege-Escsalation.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2023/Jan/14
Exploit
Mailing List
Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/multiple-post-authentication-vulnerabilities-including-rce-opentexttm-extended-ecm/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:opentext:opentext_extended_ecm:*:*:*:*:*:*:*:*

Версия от 16.2.2 (включая) до 22.3 (включая)

EPSS

Процентиль: 84%

0.02337

Низкий

7.5 High

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-200

Связанные уязвимости

GHSA-2c9x-whr5-j4x3