CVE-2023-32266

Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.

Severity Score

5.3

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation.

This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.

La vulnerabilidad de ruta de búsqueda no confiable en OpenText™ Application Lifecycle Management (ALM),Quality Center permite la inclusión de código. La vulnerabilidad permite a un usuario archivar archivos DLL maliciosos en el sistema antes de la instalación. Este problema afecta a Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.

*Credits: Vaibhav Srivastava (eSecForte Technologies Pvt. Ltd.)

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

High

User Interaction

Active

System

Vulnerable | Subsequent

Confidentiality

High

None

Integrity

High

None

Availability

None

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

High

User Interaction

Active

System

Vulnerable | Subsequent

Confidentiality

High

None

Integrity

High

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2023-05-05 CVE Reserved
2024-10-16 CVE Published
2024-10-16 CVE Updated
2024-10-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-426: Untrusted Search Path

CAPEC

CAPEC-175: Code Inclusion

References (1)

URL	Tag	Source
https://portal.microfocus.com/s/article/KM000024386?language=en_US

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
OpenText™ Search vendor "OpenText™"		Application Lifecycle Management (ALM),Quality Center Search vendor "OpenText™" for product "Application Lifecycle Management (ALM),Quality Center"				15.00 Search vendor "OpenText™" for product "Application Lifecycle Management (ALM),Quality Center" and version "15.00"		en		Affected
OpenText™ Search vendor "OpenText™"		Application Lifecycle Management (ALM),Quality Center Search vendor "OpenText™" for product "Application Lifecycle Management (ALM),Quality Center"				15.01 Search vendor "OpenText™" for product "Application Lifecycle Management (ALM),Quality Center" and version "15.01"		en		Affected
OpenText™ Search vendor "OpenText™"		Application Lifecycle Management (ALM),Quality Center Search vendor "OpenText™" for product "Application Lifecycle Management (ALM),Quality Center"				15.51 Search vendor "OpenText™" for product "Application Lifecycle Management (ALM),Quality Center" and version "15.51"		en		Affected
OpenText™ Search vendor "OpenText™"		Application Lifecycle Management (ALM),Quality Center Search vendor "OpenText™" for product "Application Lifecycle Management (ALM),Quality Center"				16.00 Search vendor "OpenText™" for product "Application Lifecycle Management (ALM),Quality Center" and version "16.00"		en		Affected