CVE-2023-32266 - Vulnerability Details

Vendors	Products
Opentext	Alm Quality Center

Link	Providers
https://portal.microfocus.com/s/article/KM000024386?language=en_US

Type	Values Removed	Values Added
First Time appeared		Opentext Opentext alm Quality Center
CPEs		cpe:2.3:a:opentext:alm_quality_center::::::::
Vendors & Products		Opentext Opentext alm Quality Center
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.
Title		Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.
Weaknesses		CWE-426
References		https://portal.microfocus.com/s/article/KM000024386?language=en_US
Metrics		cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Clear'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32266", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2023-05-05T14:42:20.153Z", "datePublished": "2024-10-16T16:28:39.168Z", "dateUpdated": "2024-10-16T19:05:48.577Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Application Lifecycle Management (ALM),Quality Center", "vendor": "OpenText\u2122", "versions": [{"status": "affected", "version": "15.00"}, {"status": "affected", "version": "15.01"}, {"status": "affected", "version": "15.01 P1"}, {"status": "affected", "version": "15.01 P2"}, {"status": "affected", "version": "15.01 P3"}, {"status": "affected", "version": "15.01 P4"}, {"status": "affected", "version": "15.01 P5"}, {"status": "affected", "version": "15.51"}, {"status": "affected", "version": "15.51 P1"}, {"status": "affected", "version": "15.51 P2"}, {"status": "affected", "version": "15.51 P3"}, {"status": "affected", "version": "16.00"}, {"status": "affected", "version": "16.01 P1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Vaibhav Srivastava (eSecForte Technologies Pvt. Ltd.)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p> <b>Untrusted Search Path vulnerability in OpenText\u2122 Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. &nbsp;</b></p><p><b>This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.</b></p>\n\n<p></p>"}], "value": "Untrusted Search Path vulnerability in OpenText\u2122 Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. \u00a0\n\nThis issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1."}], "impacts": [{"capecId": "CAPEC-175", "descriptions": [{"lang": "en", "value": "CAPEC-175 Code Inclusion"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-426", "description": "CWE-426 Untrusted Search Path", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2024-10-16T16:28:39.168Z"}, "references": [{"url": "https://portal.microfocus.com/s/article/KM000024386?language=en_US"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<a target=\"_blank\" rel=\"nofollow\" href=\"https://portal.microfocus.com/s/article/KM000024386?language=en_US\">https://portal.microfocus.com/s/article/KM000024386?language=en_US</a><br>"}], "value": "https://portal.microfocus.com/s/article/KM000024386?language=en_US"}], "source": {"discovery": "UNKNOWN"}, "title": "Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "opentext", "product": "alm_quality_center", "cpes": ["cpe:2.3:a:opentext:alm_quality_center:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "15.00", "status": "affected"}, {"version": "15.01", "status": "affected"}, {"version": "15.01_p1", "status": "affected"}, {"version": "15.01_p2", "status": "affected"}, {"version": "15.01_p3", "status": "affected"}, {"version": "15.01_p4", "status": "affected"}, {"version": "15.01_p5", "status": "affected"}, {"version": "15.51", "status": "affected"}, {"version": "15.51_p1", "status": "affected"}, {"version": "15.51_p2", "status": "affected"}, {"version": "15.51_p3", "status": "affected"}, {"version": "16.00", "status": "affected"}, {"version": "16.01_p1", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-16T18:56:01.514571Z", "id": "CVE-2023-32266", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T19:05:48.577Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-32266 (string)

assignerOrgId : f81092c5-7f14-476d-80dc-24857f90be84 (string)

state : PUBLISHED (string)

assignerShortName : OpenText (string)

dateReserved : 2023-05-05T14:42:20.153Z (string)

datePublished : 2024-10-16T16:28:39.168Z (string)

dateUpdated : 2024-10-16T19:05:48.577Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Application Lifecycle Management (ALM),Quality Center (string)

vendor : OpenText™ (string)

versions : [ »

0 : { »

status : affected (string)

version : 15.00 (string)

}

1 : { »

status : affected (string)

version : 15.01 (string)

}

2 : { »

status : affected (string)

version : 15.01 P1 (string)

}

3 : { »

status : affected (string)

version : 15.01 P2 (string)

}

4 : { »

status : affected (string)

version : 15.01 P3 (string)

}

5 : { »

status : affected (string)

version : 15.01 P4 (string)

}

6 : { »

status : affected (string)

version : 15.01 P5 (string)

}

7 : { »

status : affected (string)

version : 15.51 (string)

}

8 : { »

status : affected (string)

version : 15.51 P1 (string)

}

9 : { »

status : affected (string)

version : 15.51 P2 (string)

}

10 : { »

status : affected (string)

version : 15.51 P3 (string)

}

11 : { »

status : affected (string)

version : 16.00 (string)

}

12 : { »

status : affected (string)

version : 16.01 P1 (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Vaibhav Srivastava (eSecForte Technologies Pvt. Ltd.) (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation.  This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1. (string)

}

]

value : Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-175 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-175 Code Inclusion (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NO (string)

Recovery : NOT_DEFINED (string)

Safety : NEGLIGIBLE (string)

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

attackVector : LOCAL (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

privilegesRequired : HIGH (string)

providerUrgency : CLEAR (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : ACTIVE (string)

valueDensity : DIFFUSE (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Clear (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : HIGH (string)

vulnerabilityResponseEffort : LOW (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-426 (string)

description : CWE-426 Untrusted Search Path (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : f81092c5-7f14-476d-80dc-24857f90be84 (string)

shortName : OpenText (string)

dateUpdated : 2024-10-16T16:28:39.168Z (string)

}

references : [ »

0 : { »

url : https://portal.microfocus.com/s/article/KM000024386?language=en_US (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <a target="_blank" rel="nofollow" href="https://portal.microfocus.com/s/article/KM000024386?language=en_US">https://portal.microfocus.com/s/article/KM000024386?language=en_US</a> (string)

}

]

value : https://portal.microfocus.com/s/article/KM000024386?language=en_US (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center. (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : opentext (string)

product : alm_quality_center (string)

cpes : [ »

0 : cpe:2.3:a:opentext:alm_quality_center:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 15.00 (string)

status : affected (string)

}

1 : { »

version : 15.01 (string)

status : affected (string)

}

2 : { »

version : 15.01_p1 (string)

status : affected (string)

}

3 : { »

version : 15.01_p2 (string)

status : affected (string)

}

4 : { »

version : 15.01_p3 (string)

status : affected (string)

}

5 : { »

version : 15.01_p4 (string)

status : affected (string)

}

6 : { »

version : 15.01_p5 (string)

status : affected (string)

}

7 : { »

version : 15.51 (string)

status : affected (string)

}

8 : { »

version : 15.51_p1 (string)

status : affected (string)

}

9 : { »

version : 15.51_p2 (string)

status : affected (string)

}

10 : { »

version : 15.51_p3 (string)

status : affected (string)

}

11 : { »

version : 16.00 (string)

status : affected (string)

}

12 : { »

version : 16.01_p1 (string)

status : affected (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-16T18:56:01.514571Z (string)

id : CVE-2023-32266 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-16T19:05:48.577Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32266", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-16T18:56:01.514571Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:opentext:alm_quality_center:*:*:*:*:*:*:*:*"], "vendor": "opentext", "product": "alm_quality_center", "versions": [{"status": "affected", "version": "15.00"}, {"status": "affected", "version": "15.01"}, {"status": "affected", "version": "15.01_p1"}, {"status": "affected", "version": "15.01_p2"}, {"status": "affected", "version": "15.01_p3"}, {"status": "affected", "version": "15.01_p4"}, {"status": "affected", "version": "15.01_p5"}, {"status": "affected", "version": "15.51"}, {"status": "affected", "version": "15.51_p1"}, {"status": "affected", "version": "15.51_p2"}, {"status": "affected", "version": "15.51_p3"}, {"status": "affected", "version": "16.00"}, {"status": "affected", "version": "16.01_p1"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-16T19:05:22.495Z"}}], "cna": {"title": "Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Vaibhav Srivastava (eSecForte Technologies Pvt. Ltd.)"}], "impacts": [{"capecId": "CAPEC-175", "descriptions": [{"lang": "en", "value": "CAPEC-175 Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Clear", "providerUrgency": "CLEAR", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenText\u2122", "product": "Application Lifecycle Management (ALM),Quality Center", "versions": [{"status": "affected", "version": "15.00"}, {"status": "affected", "version": "15.01"}, {"status": "affected", "version": "15.01 P1"}, {"status": "affected", "version": "15.01 P2"}, {"status": "affected", "version": "15.01 P3"}, {"status": "affected", "version": "15.01 P4"}, {"status": "affected", "version": "15.01 P5"}, {"status": "affected", "version": "15.51"}, {"status": "affected", "version": "15.51 P1"}, {"status": "affected", "version": "15.51 P2"}, {"status": "affected", "version": "15.51 P3"}, {"status": "affected", "version": "16.00"}, {"status": "affected", "version": "16.01 P1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "https://portal.microfocus.com/s/article/KM000024386?language=en_US", "supportingMedia": [{"type": "text/html", "value": "<a target=\"_blank\" rel=\"nofollow\" href=\"https://portal.microfocus.com/s/article/KM000024386?language=en_US\">https://portal.microfocus.com/s/article/KM000024386?language=en_US</a><br>", "base64": false}]}], "references": [{"url": "https://portal.microfocus.com/s/article/KM000024386?language=en_US"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Untrusted Search Path vulnerability in OpenText\u2122 Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. \u00a0\n\nThis issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.", "supportingMedia": [{"type": "text/html", "value": "<p> <b>Untrusted Search Path vulnerability in OpenText\u2122 Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. &nbsp;</b></p><p><b>This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.</b></p>\n\n<p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426 Untrusted Search Path"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2024-10-16T16:28:39.168Z"}}}, "cveMetadata": {"cveId": "CVE-2023-32266", "state": "PUBLISHED", "dateUpdated": "2024-10-16T19:05:48.577Z", "dateReserved": "2023-05-05T14:42:20.153Z", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "datePublished": "2024-10-16T16:28:39.168Z", "assignerShortName": "OpenText"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-32266 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-16T18:56:01.514571Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:opentext:alm_quality_center:*:*:*:*:*:*:*:* (string)

]

vendor : opentext (string)

product : alm_quality_center (string)

versions : [ »

0 : { »

status : affected (string)

version : 15.00 (string)

}

1 : { »

status : affected (string)

version : 15.01 (string)

}

2 : { »

status : affected (string)

version : 15.01_p1 (string)

}

3 : { »

status : affected (string)

version : 15.01_p2 (string)

}

4 : { »

status : affected (string)

version : 15.01_p3 (string)

}

5 : { »

status : affected (string)

version : 15.01_p4 (string)

}

6 : { »

status : affected (string)

version : 15.01_p5 (string)

}

7 : { »

status : affected (string)

version : 15.51 (string)

}

8 : { »

status : affected (string)

version : 15.51_p1 (string)

}

9 : { »

status : affected (string)

version : 15.51_p2 (string)

}

10 : { »

status : affected (string)

version : 15.51_p3 (string)

}

11 : { »

status : affected (string)

version : 16.00 (string)

}

12 : { »

status : affected (string)

version : 16.01_p1 (string)

}

]

defaultStatus : unaffected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-16T19:05:22.495Z (string)

}

]

cna : { »

title : Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center. (string)

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Vaibhav Srivastava (eSecForte Technologies Pvt. Ltd.) (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-175 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-175 Code Inclusion (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NEGLIGIBLE (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 5.3 (number)

Automatable : NO (string)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

valueDensity : DIFFUSE (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Clear (string)

providerUrgency : CLEAR (string)

userInteraction : ACTIVE (string)

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

privilegesRequired : HIGH (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : HIGH (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnerabilityResponseEffort : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : OpenText™ (string)

product : Application Lifecycle Management (ALM),Quality Center (string)

versions : [ »

0 : { »

status : affected (string)

version : 15.00 (string)

}

1 : { »

status : affected (string)

version : 15.01 (string)

}

2 : { »

status : affected (string)

version : 15.01 P1 (string)

}

3 : { »

status : affected (string)

version : 15.01 P2 (string)

}

4 : { »

status : affected (string)

version : 15.01 P3 (string)

}

5 : { »

status : affected (string)

version : 15.01 P4 (string)

}

6 : { »

status : affected (string)

version : 15.01 P5 (string)

}

7 : { »

status : affected (string)

version : 15.51 (string)

}

8 : { »

status : affected (string)

version : 15.51 P1 (string)

}

9 : { »

status : affected (string)

version : 15.51 P2 (string)

}

10 : { »

status : affected (string)

version : 15.51 P3 (string)

}

11 : { »

status : affected (string)

version : 16.00 (string)

}

12 : { »

status : affected (string)

version : 16.01 P1 (string)

}

]

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : https://portal.microfocus.com/s/article/KM000024386?language=en_US (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : <a target="_blank" rel="nofollow" href="https://portal.microfocus.com/s/article/KM000024386?language=en_US">https://portal.microfocus.com/s/article/KM000024386?language=en_US</a> (string)

base64 : false (boolean)

}

]

}

]

references : [ »

0 : { »

url : https://portal.microfocus.com/s/article/KM000024386?language=en_US (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation.  This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-426 (string)

description : CWE-426 Untrusted Search Path (string)

}

]

}

]

providerMetadata : { »

orgId : f81092c5-7f14-476d-80dc-24857f90be84 (string)

shortName : OpenText (string)

dateUpdated : 2024-10-16T16:28:39.168Z (string)

}

cveMetadata : { »

cveId : CVE-2023-32266 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-16T19:05:48.577Z (string)

dateReserved : 2023-05-05T14:42:20.153Z (string)

assignerOrgId : f81092c5-7f14-476d-80dc-24857f90be84 (string)

datePublished : 2024-10-16T16:28:39.168Z (string)

assignerShortName : OpenText (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Untrusted Search Path vulnerability in OpenText\u2122 Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. \u00a0\n\nThis issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1."}, {"lang": "es", "value": "La vulnerabilidad de ruta de b\u00fasqueda no confiable en OpenText\u2122 Application Lifecycle Management (ALM),Quality Center permite la inclusi\u00f3n de c\u00f3digo. La vulnerabilidad permite a un usuario archivar archivos DLL maliciosos en el sistema antes de la instalaci\u00f3n. Este problema afecta a Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1."}], "id": "CVE-2023-32266", "lastModified": "2024-10-18T12:53:04.627", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "automatable": "NO", "availabilityRequirements": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "CLEAR", "recovery": "NOT_DEFINED", "safety": "NEGLIGIBLE", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "ACTIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:L/U:Clear", "version": "4.0", "vulnerabilityResponseEffort": "LOW", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "security@opentext.com", "type": "Secondary"}]}, "published": "2024-10-16T17:15:13.097", "references": [{"source": "security@opentext.com", "url": "https://portal.microfocus.com/s/article/KM000024386?language=en_US"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "security@opentext.com", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1. (string)

}

1 : { »

lang : es (string)

value : La vulnerabilidad de ruta de búsqueda no confiable en OpenText™ Application Lifecycle Management (ALM),Quality Center permite la inclusión de código. La vulnerabilidad permite a un usuario archivar archivos DLL maliciosos en el sistema antes de la instalación. Este problema afecta a Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1. (string)

}

]

id : CVE-2023-32266 (string)

lastModified : 2024-10-18T12:53:04.627 (string)

metrics : { »

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : PRESENT (string)

attackVector : LOCAL (string)

automatable : NO (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : HIGH (string)

providerUrgency : CLEAR (string)

recovery : NOT_DEFINED (string)

safety : NEGLIGIBLE (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : NONE (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : ACTIVE (string)

valueDensity : DIFFUSE (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:L/U:Clear (string)

version : 4.0 (string)

vulnerabilityResponseEffort : LOW (string)

vulnerableSystemAvailability : NONE (string)

vulnerableSystemConfidentiality : HIGH (string)

vulnerableSystemIntegrity : HIGH (string)

}

source : security@opentext.com (string)

type : Secondary (string)

}

]

}

published : 2024-10-16T17:15:13.097 (string)

references : [ »

0 : { »

source : security@opentext.com (string)

url : https://portal.microfocus.com/s/article/KM000024386?language=en_US (string)

}

]

sourceIdentifier : security@opentext.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-426 (string)

}

]

source : security@opentext.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object