Critical · published September 12, 2023
🚨 An attacker can waltz right in with any username in OpenText Visual COBOL products, as passwords are utterly ignored in certain LDAP configurations—yikes! 🔥 Think of it like a restaurant where anyone can walk in and sit at any table, no reservation needed, because the host doesn’t bother to check if they actually have a booking or even a clue who they are! This vulnerability could lead to an absolute invasion of your sensitive data—an attacker could impersonate any user, potentially accessing confidential information or performing unauthorized actions. Imagine the chaos of someone posing as your CEO to give orders they shouldn't be able to!
Think of it like a restaurant where anyone can walk in and sit at any table, no reservation needed, because the host doesn’t bother to check if they actually have a booking or even a clue who they are! In OpenText Visual COBOL, certain configurations allow usernames to authenticate without checking passwords, effectively bypassing security measures. This means that even invalid usernames can log in successfully—like a free pass to the VIP lounge!
This vulnerability could lead to an absolute invasion of your sensitive data—an attacker could impersonate any user, potentially accessing confidential information or performing unauthorized actions. Imagine the chaos of someone posing as your CEO to give orders they shouldn't be able to! To mitigate this, update to the latest patch version as soon as it’s available for your product. In the meantime, check your installations by attempting to log in with valid usernames and incorrect passwords to see if your configuration is vulnerable. Consult OpenText Support for overlay and workaround instructions. You've got this, security hero! With these steps, you’ll tighten the bolts on your defenses in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| microfocus/cobol_server | all versions | — |
| microfocus/cobol_server | all versions | — |
| microfocus/cobol_server | all versions | — |
| microfocus/cobol_server | all versions | — |
| microfocus/cobol_server | all versions | — |
| microfocus/enterprise_developer | all versions | — |
| microfocus/enterprise_developer | all versions | — |
| microfocus/enterprise_developer | all versions | — |
| microfocus/enterprise_developer | all versions | — |
| microfocus/enterprise_developer | all versions | — |
| microfocus/enterprise_server | all versions | — |
| microfocus/enterprise_server | all versions | — |
| microfocus/enterprise_server | all versions | — |
| microfocus/enterprise_server | all versions | — |
| microfocus/enterprise_server | all versions | — |
| microfocus/enterprise_test_server | all versions | — |
| microfocus/enterprise_test_server | all versions | — |
| microfocus/enterprise_test_server | all versions | — |
| microfocus/enterprise_test_server | all versions | — |
| microfocus/enterprise_test_server | all versions | — |
| microfocus/visual_cobol | all versions | — |
| microfocus/visual_cobol | all versions | — |
| microfocus/visual_cobol | all versions | — |
| microfocus/visual_cobol | all versions | — |
| microfocus/visual_cobol | all versions | — |