CVE-2023-4501CWE-253CWE-287CWE-305CWE-358

CVE-2023-4501

Critical · published September 12, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

🚨 An attacker can waltz right in with any username in OpenText Visual COBOL products, as passwords are utterly ignored in certain LDAP configurations—yikes! 🔥 Think of it like a restaurant where anyone can walk in and sit at any table, no reservation needed, because the host doesn’t bother to check if they actually have a booking or even a clue who they are! This vulnerability could lead to an absolute invasion of your sensitive data—an attacker could impersonate any user, potentially accessing confidential information or performing unauthorized actions. Imagine the chaos of someone posing as your CEO to give orders they shouldn't be able to!

Put simply

Think of it like a restaurant where anyone can walk in and sit at any table, no reservation needed, because the host doesn’t bother to check if they actually have a booking or even a clue who they are! In OpenText Visual COBOL, certain configurations allow usernames to authenticate without checking passwords, effectively bypassing security measures. This means that even invalid usernames can log in successfully—like a free pass to the VIP lounge!

What to do

This vulnerability could lead to an absolute invasion of your sensitive data—an attacker could impersonate any user, potentially accessing confidential information or performing unauthorized actions. Imagine the chaos of someone posing as your CEO to give orders they shouldn't be able to! To mitigate this, update to the latest patch version as soon as it’s available for your product. In the meantime, check your installations by attempting to log in with valid usernames and incorrect passwords to see if your configuration is vulnerable. Consult OpenText Support for overlay and workaround instructions. You've got this, security hero! With these steps, you’ll tighten the bolts on your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00758 · 54.7th percentile
Weaknesses
CWE-253 · Incorrect Check of Function Return Value; CWE-287 · Improper Authentication; CWE-305 · Authentication Bypass by Primary Weakness; CWE-358 · Improperly Implemented Security Check for Standard
Published
2023-09-12T23:15Z
Affected products (25)
ProductVersionsFixed in
microfocus/cobol_serverall versions—
microfocus/cobol_serverall versions—
microfocus/cobol_serverall versions—
microfocus/cobol_serverall versions—
microfocus/cobol_serverall versions—
microfocus/enterprise_developerall versions—
microfocus/enterprise_developerall versions—
microfocus/enterprise_developerall versions—
microfocus/enterprise_developerall versions—
microfocus/enterprise_developerall versions—
microfocus/enterprise_serverall versions—
microfocus/enterprise_serverall versions—
microfocus/enterprise_serverall versions—
microfocus/enterprise_serverall versions—
microfocus/enterprise_serverall versions—
microfocus/enterprise_test_serverall versions—
microfocus/enterprise_test_serverall versions—
microfocus/enterprise_test_serverall versions—
microfocus/enterprise_test_serverall versions—
microfocus/enterprise_test_serverall versions—
microfocus/visual_cobolall versions—
microfocus/visual_cobolall versions—
microfocus/visual_cobolall versions—
microfocus/visual_cobolall versions—
microfocus/visual_cobolall versions—
References (2)
EPSS history
Timeline
  • 12 SEP 18:05Z
    Authentication bypass in OpenText (Micro Focus) Enterprise Server
    cvelistv5