CVE-2023-4553 (GCVE-0-2023-4553)

Vulnerability from cvelistv5 – Published: 2024-01-29 20:56 – Updated: 2024-08-28 20:19
VLAI?
Title
Unauthenticated Access to AppBuilder Configuration Files
Summary
Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. AppBuilder configuration files are viewable by unauthenticated users. This issue affects AppBuilder: from 21.2 before 23.2.
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-20 - Improper Input Validation
Assigner
References
Impacted products
Vendor Product Version
OpenText AppBuilder Unaffected: 23.2
Affected: 21.2 , < 23.2 (custom)
Create a notification for this product.
Credits
George Mathias
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:31:06.052Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:opentext:appbuilder:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "appbuilder",
            "vendor": "opentext",
            "versions": [
              {
                "lessThan": "23.2",
                "status": "affected",
                "version": "21.2",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "23.2"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-4553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-28T20:07:57.507294Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-28T20:19:02.071Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "AppBuilder",
          "vendor": "OpenText",
          "versions": [
            {
              "status": "unaffected",
              "version": "23.2"
            },
            {
              "lessThan": "23.2",
              "status": "affected",
              "version": "21.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "George Mathias"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eAppBuilder configuration files are viewable by unauthenticated users.\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis issue affects AppBuilder: from 21.2 before 23.2.\u003c/p\u003e"
            }
          ],
          "value": "Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.\n\n\nAppBuilder configuration files are viewable by unauthenticated users.\n\n\nThis issue affects AppBuilder: from 21.2 before 23.2.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-639",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-639 Probe System Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-29T20:56:45.438Z",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "OpenText"
      },
      "references": [
        {
          "url": "https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated Access to AppBuilder Configuration Files",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "OpenText",
    "cveId": "CVE-2023-4553",
    "datePublished": "2024-01-29T20:56:45.438Z",
    "dateReserved": "2023-08-25T16:55:11.027Z",
    "dateUpdated": "2024-08-28T20:19:02.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-4553",
      "date": "2026-04-27",
      "epss": "0.0007",
      "percentile": "0.21331"
    },
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:opentext:appbuilder:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"21.2\", \"versionEndExcluding\": \"23.2\", \"matchCriteriaId\": \"8F278A97-1D94-451A-8563-6ADB44E5EBAB\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.\\n\\n\\nAppBuilder configuration files are viewable by unauthenticated users.\\n\\n\\nThis issue affects AppBuilder: from 21.2 before 23.2.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de validaci\\u00f3n de entrada incorrecta en OpenText AppBuilder en Windows, Linux permite sondear archivos del sistema. Los usuarios no autenticados pueden ver los archivos de configuraci\\u00f3n de AppBuilder. Este problema afecta a AppBuilder: desde 21.2 antes de 23.2.\"}]",
      "id": "CVE-2023-4553",
      "lastModified": "2024-11-21T08:35:24.447",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@opentext.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-01-29T21:15:09.263",
      "references": "[{\"url\": \"https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b\", \"source\": \"security@opentext.com\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\"]}]",
      "sourceIdentifier": "security@opentext.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@opentext.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-4553\",\"sourceIdentifier\":\"security@opentext.com\",\"published\":\"2024-01-29T21:15:09.263\",\"lastModified\":\"2024-11-21T08:35:24.447\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.\\n\\n\\nAppBuilder configuration files are viewable by unauthenticated users.\\n\\n\\nThis issue affects AppBuilder: from 21.2 before 23.2.\\n\\n\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de validaci\u00f3n de entrada incorrecta en OpenText AppBuilder en Windows, Linux permite sondear archivos del sistema. Los usuarios no autenticados pueden ver los archivos de configuraci\u00f3n de AppBuilder. Este problema afecta a AppBuilder: desde 21.2 antes de 23.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@opentext.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security@opentext.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opentext:appbuilder:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"21.2\",\"versionEndExcluding\":\"23.2\",\"matchCriteriaId\":\"8F278A97-1D94-451A-8563-6ADB44E5EBAB\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b\",\"source\":\"security@opentext.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T07:31:06.052Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-4553\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-28T20:07:57.507294Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:opentext:appbuilder:*:*:*:*:*:*:*:*\"], \"vendor\": \"opentext\", \"product\": \"appbuilder\", \"versions\": [{\"status\": \"affected\", \"version\": \"21.2\", \"lessThan\": \"23.2\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"23.2\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-28T20:17:34.186Z\"}}], \"cna\": {\"title\": \"Unauthenticated Access to AppBuilder Configuration Files\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"George Mathias\"}], \"impacts\": [{\"capecId\": \"CAPEC-639\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-639 Probe System Files\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"OpenText\", \"product\": \"AppBuilder\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"23.2\"}, {\"status\": \"affected\", \"version\": \"21.2\", \"lessThan\": \"23.2\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://support.opentext.com/csm?id=ot_kb_search\u0026kb_category=61648712db61781068cfd6c4e296197b\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.\\n\\n\\nAppBuilder configuration files are viewable by unauthenticated users.\\n\\n\\nThis issue affects AppBuilder: from 21.2 before 23.2.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003eImproper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eAppBuilder configuration files are viewable by unauthenticated users.\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis issue affects AppBuilder: from 21.2 before 23.2.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"f81092c5-7f14-476d-80dc-24857f90be84\", \"shortName\": \"OpenText\", \"dateUpdated\": \"2024-01-29T20:56:45.438Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-4553\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-28T20:19:02.071Z\", \"dateReserved\": \"2023-08-25T16:55:11.027Z\", \"assignerOrgId\": \"f81092c5-7f14-476d-80dc-24857f90be84\", \"datePublished\": \"2024-01-29T20:56:45.438Z\", \"assignerShortName\": \"OpenText\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.