CVE-2023-4550: opentext appbuilder Improper Input Validation
Vulnerability summary
CVE-2023-4550 is a high (CVSS 7.5) Improper Input Validation vulnerability in opentext appbuilder. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities.
Timeline
- 29-01-2024PublishedVulnerability first disclosed.
- 12-11-2024Last modifiedVulnerability information updated.
Description
Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted. This issue affects AppBuilder: from 21.2 before 23.2.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
0.00 pp
From 0.47% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
Affected systems
Opentext1 product
- appbuilder≥ 21.2, < 23.2
1 vendor · 1 product