SECUFOCUSNOW
Home›CVE index›CVE-2023-4501
Review reviewCritical

CVE-2023-4501

OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server, visual_cobal_cobal_server_enterprise_developer_enterprise_server, cobol server

User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows...

CVSS
9.8
EPSS
0.62%
46.4% percentile
CISA KEV
Not listed
Published
2023.09.13
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.62%
Technical severityCVSS 9.8

Vulnerability overview

User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows...

Affected product and versions

Product
OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server, visual_cobal_cobal_server_enterprise_developer_enterprise_server, cobol server
Affected versions
>= 7.0.19 < 7.0.21, >= 8.0.8 < 8.0.10, >= 9.0.1 < 9.0.2, 7.0, 8.0, 9.0
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server, visual_cobal_cobal_server_enterprise_developer_enterprise_server, cobol server and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-253, CWE-287, CWE-305, CWE-358