CVE-2022-45927

Опубликовано: 18 янв. 2023

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java application server can be used to bypass the authentication of the QDS endpoints of the Content Server. These endpoints can be used to create objects and execute arbitrary code.

Ссылки

http://packetstormsecurity.com/files/170614/OpenText-Extended-ECM-22.3-Java-Frontend-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2023/Jan/13
Exploit
Mailing List
Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/pre-authenticated-remote-code-execution-via-java-frontend-qds-endpoint-opentext-extended-ecm/
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/170614/OpenText-Extended-ECM-22.3-Java-Frontend-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2023/Jan/13
Exploit
Mailing List
Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/pre-authenticated-remote-code-execution-via-java-frontend-qds-endpoint-opentext-extended-ecm/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:opentext:opentext_extended_ecm:*:*:*:*:*:*:*:*

Версия от 20.4 (включая) до 22.4 (исключая)

EPSS

Процентиль: 79%

0.01244

Низкий

8.8 High

CVSS3

Дефекты

CWE-639

Связанные уязвимости

GHSA-rp59-mwr6-m562