« Volver al listado

CVE-2024-8125

Estado: AplazadaMedia (5.4)—

Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Parameter Injection.

A bad actor with the required OpenText Content Management privileges (not root) could expose the vulnerability to carry out a remote code execution attack on the target system.

This issue affects Content Management (Extended ECM): from 10.0 through 24.4

with WebReports module installed and enabled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Opentext — Content ManagementAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8125",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8125",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-04T21:35:07.437156Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@opentext.com",
        "cvssData": {
          "Safety": "PRESENT",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 5.4,
          "Automatable": "NO",
          "attackVector": "ADJACENT",
          "baseSeverity": "MEDIUM",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:C/RE:H/U:Amber",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "AMBER",
          "userInteraction": "PASSIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "HIGH",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "OpenText™",
          "product": "Content Management (Extended ECM)",
          "versions": [
            {
              "status": "affected",
              "version": "10.0",
              "versionType": "custom",
              "lessThanOrEqual": "24.4"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-04T22:15:41.573",
  "references": [
    {
      "url": "https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0834058",
      "source": "security@opentext.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@opentext.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Parameter Injection. \n\nA bad actor with the required OpenText Content Management privileges (not root) could expose\nthe vulnerability to carry out a remote code execution attack on the target system.\n\nThis issue affects Content Management (Extended ECM): from 10.0 through 24.4 \n\n with WebReports module\ninstalled and enabled."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de validación incorrecta del tipo de entrada especificado en OpenText™ Content Management (Extended ECM) permite la inyección de parámetros. Un actor malintencionado con los privilegios necesarios de OpenText Content Management (no root) podría exponer la vulnerabilidad para llevar a cabo un ataque de ejecución de código remoto en el sistema de destino. Este problema afecta a Content Management (Extended ECM): desde la versión 10.0 hasta la 24.4 con el módulo WebReports instalado y habilitado."
    }
  ],
  "lastModified": "2026-06-17T08:21:56.143",
  "sourceIdentifier": "security@opentext.com"
}