CVE-2023-7248

EUVD-2023-59429

15.03.2024, 20:15

Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. 

The vulnerability would affect one of Vertica’s authentication functionalities by allowing specially crafted requests and sequences. 
This issue impacts the following Vertica Management Console versions:
10.x
11.1.1-24 or lower
12.0.4-18 or lower

Please upgrade to one of the following Vertica Management Console versions:
10.x to upgrade to latest versions from below.
11.1.1-25
12.0.4-19
23.x
24.x

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
OpenText	CNA	5 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 7%

Affected Products (NVD)

Vendor	Product	Version
opentext	vertica	10.0.0-0 ≤ 𝑥 ≤ 10.1.1-26
opentext	vertica	11.0.0-0 ≤ 𝑥 < 11.1.1-25
opentext	vertica	12.0.0-0 ≤ 𝑥 < 12.0.4-19

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://portal.microfocus.com/s/article/KM000027542?language=en_US