CVE-2023-4551

Command Injection via Task Scheduler

State: Published
Severity: 7.2 High
Published: Jan 29, 2024
Updated: Aug 2, 2024
Reserved: Aug 25, 2023

Description

Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows OS Command Injection.

The AppBuilder's Scheduler functionality that facilitates creation of scheduled tasks is vulnerable to command injection. This allows authenticated users to inject arbitrary operating system commands into the executing process.

This issue affects AppBuilder: from 21.2 before 23.2.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	OpenText

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
AppBuilderOpenText	23.2Not affected 21.2 to before 23.2Affected

References

https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.