CVE-2022-45928

A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803)

High · published January 18, 2023

CVSS v3.1
8.8
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). Multiple endpoints allow the user to pass the parameter htmlFile, which is included in the HTML output rendering pipeline of a request. Because the Content Server evaluates and executes Oscript code in HTML files, it is possible for an attacker to execute Oscript code. The Oscript scripting language allows the attacker (for example) to manipulate files on the filesystem, create new network connections, or execute OS commands.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01743 · 77.6th percentile
Published
2023-01-18T00:00Z
EPSS history
Timeline
  • 18 JAN 00:00Z
    A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803)
    cvelistv5