CVE-2023-4554

MEDIUM

OpenText AppBuilder 21.2-23.2 - Authenticated XML External Entity Injection

Title source: llm

Description

Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files. AppBuilder's XML processor is vulnerable to XML External Entity Processing (XXE), allowing an authenticated user to upload specially crafted XML files to induce server-side request forgery, disclose files local to the server that processes them. This issue affects AppBuilder: from 21.2 before 23.2.

References (1)

Core 1

Core References

Permissions Required

https://support.opentext.com/csm?id=ot_kb_search&kb_category=61648712db61781068cfd6c4e296197b

Scores

CVSS v3 4.9

EPSS 0.0043

EPSS Percentile 34.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (1)

opentext/appbuilder 21.2 - 23.2

Published Jan 29, 2024

Tracked Since Feb 18, 2026