VulnerabilityModified

CVE-2023-7248

Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests.

CRITICAL 9.8EPSS 0.32%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Certain functionality in OpenText Vertica Management console might be prone to bypass via crafted requests. The vulnerability would affect one of Vertica’s authentication functionalities by allowing specially crafted requests and sequences. This issue impacts the following Vertica Management Console versions: 10.x 11.1.1-24 or lower 12.0.4-18 or lower Please upgrade to one of the following Vertica Management Console versions: 10.x to upgrade to latest versions from below. 11.1.1-25 12.0.4-19 23.x 24.x

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.32% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: opentext/vertica
Source: security@opentext.com

References

https://portal.microfocus.com/s/article/KM000027542?language=en_USVendor Advisory
https://portal.microfocus.com/s/article/KM000027542?language=en_USVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.