CVE-2023-4551
Assigner: OpenText
Published: 2024-01-29T20:56:30.404Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Windows
Linux
product: AppBuilder
vendor: OpenText
versions: status: unaffected
version: 23.2
lessThan: 23.2
status: affected
version: 21.2
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: George Mathias
descriptions: supportingMedia: base64: no
type: text/html
value: <div>Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection.</div><div>The AppBuilder's Scheduler functionality that facilitates creation of scheduled tasks is vulnerable to command injection. This allows authenticated users to inject arbitrary operating system commands into the executing process.<br></div><p>This issue affects AppBuilder: from 21.2 before 23.2.</p>
value: Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection.

The AppBuilder's Scheduler functionality that facilitates creation of scheduled tasks is vulnerable to command injection. This allows authenticated users to inject arbitrary operating system commands into the executing process.


This issue affects AppBuilder: from 21.2 before 23.2.


impacts: capecId: CAPEC-88
descriptions: value: CAPEC-88 OS Command Injection
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: discovery: UNKNOWN
title: Command Injection via Task Scheduler
x_generator: engine: Vulnogram 0.1.0-dev