Command Injection via Task Scheduler
CVE-2023-4551

7.2HIGH

Key Information:

Vendor
Opentext
Status
Appbuilder
Vendor
CVE Published:
29 January 2024

Summary

An improper input validation vulnerability exists in OpenText AppBuilder, affecting both Windows and Linux platforms. This flaw enables authenticated users to execute arbitrary operating system commands through the Scheduler functionality, which is designed to create scheduled tasks. By exploiting this vulnerability, an attacker could manipulate the executed process, leading to potential unauthorized access or control over the system environment. The affected versions include AppBuilder from 21.2 up to but not including 23.2.

Affected Version(s)

AppBuilder Windows 21.2 < 23.2

AppBuilder Windows 23.2

References

https://support.opentext.com/csm?id=ot_kb_search&kb_categ...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Mathias
.