CVE-2023-7248

15.03.2024, 20:15

Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests.

The vulnerability would affect one of Verticas authentication functionalities by allowing specially crafted requests and sequences. 
This issue impacts the following Vertica Management Console versions:
10.x
11.1.1-24 or lower
12.0.4-18 or lower

Please upgrade to one of the following Vertica Management Console versions:
10.x to upgrade to latest versions from below.
11.1.1-25
12.0.4-19
23.x
24.x

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
OpenText	CNA	5 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 4%

Vendor	Product	Version
opentext	vertica	10.0.0-0 ≤ 𝑥 ≤ 10.1.1-26
opentext	vertica	11.0.0-0 ≤ 𝑥 < 11.1.1-25
opentext	vertica	12.0.0-0 ≤ 𝑥 < 12.0.4-19

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://portal.microfocus.com/s/article/KM000027542?language=en_US