Dwelling › Vulnerabilities

Important Vulnerabilities Patched in OpenText Enterprise Content material Administration System

By Eduard Kovacs on January 20, 2023

Tweet

A number of vulnerabilities described as having essential and excessive affect, together with ones permitting unauthenticated distant code execution, have been discovered and patched in OpenText’s enterprise content material administration (ECM) product.

The vulnerabilities have been found by a researcher at cybersecurity consultancy Sec Seek the advice of in OpenText’s Prolonged ECM, which is designed for managing the distribution and use of data throughout a company. Particularly, the failings affect the product’s Content material Server element.

The safety agency this week revealed three completely different advisories describing its findings.

OpenText was knowledgeable concerning the vulnerabilities in October 2022 and patched them earlier this month with the discharge of model 22.4, based on Sec Seek the advice of.

One of many essential vulnerabilities, tracked as CVE-2022-45923, can permit an unauthenticated attacker to execute arbitrary code utilizing specifically crafted requests.

The second essential flaw, CVE-2022-45927, impacts the Java Frontend of the OpenText Content material Server element and might permit an attacker to bypass authentication. Exploitation may finally result in distant code execution.

Sec Seek the advice of has additionally recognized 5 varieties of vulnerabilities within the Content material Server element that may be exploited by authenticated attackers.

These points, rated ‘excessive affect’, will be exploited to delete arbitrary recordsdata on the server, escalate privileges, receive doubtlessly priceless info, launch server-side request forgery (SSRF) assaults, and execute arbitrary code.

Proof-of-concept (PoC) code is accessible for the high-impact points, however the advisories describing the essential flaws don’t embody PoC code in an effort to forestall malicious exploitation.

Associated: Vendor Refuses to Take away Backdoor Account That Can Facilitate Assaults on Industrial Companies

Associated: InfiRay Thermal Digicam Flaws Can Enable Hackers to Tamper With Industrial Processes

Associated: OpenText Acquires E-mail Safety Agency Zix for $860 Million

Get the Day by day Briefing

• Most Current
• Most Learn

• In-the-Wild Exploitation of Current ManageEngine Vulnerability Commences
• Subtle ‘VastFlux’ Advert Fraud Scheme That Spoofed 1,700 Apps Disrupted
• Important Vulnerabilities Patched in OpenText Enterprise Content material Administration System
• EU’s Breton Warns TikTok CEO: Comply With New Digital Guidelines
• PayPal Warns 35,000 Customers of Credential Stuffing Assaults
• Ransomware Income Plunged in 2022 as Extra Victims Refuse to Pay Up: Report
• Chinese language Hackers Exploited Fortinet VPN Vulnerability as Zero-Day
• A Change in Mindset: From a Risk-based to Threat-based Strategy to Safety
• Ransomware Shuts A whole lot of Yum Manufacturers Eating places in UK
• Drupal Patches Vulnerabilities Resulting in Info Disclosure

On the lookout for Malware in All of the Improper Locations?

First Step For The Web’s subsequent 25 years: Including Safety to the DNS

Tattle Story: What Your Laptop Says About You

Be in a Place to Act By way of Cyber Situational Consciousness

Report Exhibits Closely Regulated Industries Letting Social Networking Apps Run Rampant

2010, A Nice 12 months To Be a Scammer.

Do not Let DNS be Your Single Level of Failure

The way to Establish Malware in a Blink

Defining and Debating Cyber Warfare

The 5 A’s that Make Cybercrime so Enticing

The way to Defend Towards DDoS Assaults

Safety Budgets Not in Line with Threats

Anycast – Three Causes Why Your DNS Community Ought to Use It

The Evolution of the Prolonged Enterprise: Safety Methods for Ahead Considering Organizations

Utilizing DNS Throughout the Prolonged Enterprise: It’s Dangerous Enterprise

SecurityWeek Podcast

Orbit Brain

http://orbitbrain.com/

Orbit Brain is the senior science writer and technology expert. Our aim provides the best information about technology and web development designing SEO graphics designing video animation tutorials and how to use software easy ways
and much more. Like Best Service Latest Technology, Information Technology, Personal Tech Blogs, Technology Blog Topics, Technology Blogs For Students, Futurism Blog.