CVE-2023-24466 - Vulnerability Details - OpenCVE

ReportizFlow

Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Opentext	Imanager

No data.

No data.

References

Link	Providers
https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch3_releasenotes/imanager326_patch3_releasenotes.pdf

History

Mon, 25 Nov 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Opentext Opentext imanager
CPEs		cpe:2.3:a:opentext:imanager::::::::
Vendors & Products		Opentext Opentext imanager
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 22 Nov 2024 15:45:00 +0000

Type	Values Removed	Values Added
Description		Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200.
Title		Possible XML External Entity Injection in OpenText iManager
Weaknesses		CWE-611
References		https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch3_releasenotes/imanager326_patch3_releasenotes.pdf
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: OpenText

Published: 2024-11-22T15:34:31.683Z

Updated: 2024-11-25T18:12:11.291Z

Reserved: 2023-01-23T21:31:58.769Z

Link: CVE-2023-24466

Vulnrichment

Updated: 2024-11-25T18:12:04.393Z

NVD

Status : Received

Published: 2024-11-22T16:15:19.673

Modified: 2024-11-22T16:15:19.673

Link: CVE-2023-24466

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-24466", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2023-01-23T21:31:58.769Z", "datePublished": "2024-11-22T15:34:31.683Z", "dateUpdated": "2024-11-25T18:12:11.291Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["Windows", "Linux", "64 bit"], "product": "iManager", "vendor": "OpenText", "versions": [{"lessThanOrEqual": "3.2.6.0200", "status": "affected", "version": "3.0.0", "versionType": "rpm, exe"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<strong>Possible XML External Entity Injection\n\n\n in iManager GET parameter </strong><strong>has been discovered in\nOpenText\u2122 </strong><strong>iManager 3.2.6.0200</strong><strong>.<br></strong>"}], "value": "Possible XML External Entity Injection\n\n\n in iManager GET parameter has been discovered in\nOpenText\u2122 iManager 3.2.6.0200."}], "impacts": [{"capecId": "CAPEC-221", "descriptions": [{"lang": "en", "value": "CAPEC-221 Data Serialization External Entities Blowup"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2024-11-22T15:34:31.683Z"}, "references": [{"url": "https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch3_releasenotes/imanager326_patch3_releasenotes.pdf"}], "source": {"discovery": "UNKNOWN"}, "title": "Possible XML External Entity Injection in OpenText iManager", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "opentext", "product": "imanager", "cpes": ["cpe:2.3:a:opentext:imanager:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.0.0", "status": "affected", "lessThanOrEqual": "3.2.6.0200", "versionType": "rpm"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-25T18:09:43.291349Z", "id": "CVE-2023-24466", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T18:12:11.291Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-24466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-25T18:09:43.291349Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:opentext:imanager:*:*:*:*:*:*:*:*"], "vendor": "opentext", "product": "imanager", "versions": [{"status": "affected", "version": "3.0.0", "versionType": "rpm", "lessThanOrEqual": "3.2.6.0200"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T18:12:04.393Z"}}], "cna": {"title": "Possible XML External Entity Injection in OpenText iManager", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-221", "descriptions": [{"lang": "en", "value": "CAPEC-221 Data Serialization External Entities Blowup"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenText", "product": "iManager", "versions": [{"status": "affected", "version": "3.0.0", "versionType": "rpm, exe", "lessThanOrEqual": "3.2.6.0200"}], "platforms": ["Windows", "Linux", "64 bit"], "defaultStatus": "affected"}], "references": [{"url": "https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch3_releasenotes/imanager326_patch3_releasenotes.pdf"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Possible XML External Entity Injection\n\n\n in iManager GET parameter has been discovered in\nOpenText\u2122 iManager 3.2.6.0200.", "supportingMedia": [{"type": "text/html", "value": "<strong>Possible XML External Entity Injection\n\n\n in iManager GET parameter </strong><strong>has been discovered in\nOpenText\u2122 </strong><strong>iManager 3.2.6.0200</strong><strong>.<br></strong>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2024-11-22T15:34:31.683Z"}}}, "cveMetadata": {"cveId": "CVE-2023-24466", "state": "PUBLISHED", "dateUpdated": "2024-11-25T18:12:11.291Z", "dateReserved": "2023-01-23T21:31:58.769Z", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "datePublished": "2024-11-22T15:34:31.683Z", "assignerShortName": "OpenText"}, "dataVersion": "5.1"}