Armin Stock

In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server if the filenames are known.

**Name of the Vulnerable Software and Affected Versions** ILIAS versions 7.21 through 8.2 **Description** The issue concerns stored Cross Site Scripting (XSS), which is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For ILIAS versions 7.21 through 8.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ILIAS versions 7.21 through 8.2 **Description** The issue is related to reflected Cross-Site Scripting (XSS), which allows an attacker to inject malicious scripts into a website. This can lead to unauthorized access to user data or session hijacking. **Recommendations** For ILIAS versions 7.21 through 8.2, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenText Content Suite Platform version 16.2.19.1803 **Description** An issue was discovered that allows a low-privilege user to delete arbitrary files on the server's local filesystem through the "itemtemplate.createtemplate2" endpoint. **Recommendations** For OpenText Content Suite Platform version 16.2.19.1803, consider restricting access to the "itemtemplate.createtemplate2" endpoint to prevent low-privilege users from deleting arbitrary files on the server's local filesystem.

**Name of the Vulnerable Software and Affected Versions** OpenText Content Suite Platform version 16.2.19.1803 **Description** An issue was discovered that allows a low-privilege user to evaluate web reports through the "notify.localizeEmailTemplate" endpoint. **Recommendations** For OpenText Content Suite Platform version 16.2.19.1803, consider restricting access to the "notify.localizeEmailTemplate" endpoint to prevent low-privilege users from evaluating web reports until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OpenText Content Suite Platform version 22.1 (16.2.19.1803) **Description** An issue in the Java application server allows bypassing authentication of QDS endpoints in the Content Server. These endpoints can be exploited to create objects and execute arbitrary code. **Recommendations** For OpenText Content Suite Platform version 22.1 (16.2.19.1803), consider restricting access to the QDS endpoints of the Content Server until a patch is available. As a temporary workaround, disabling the Java application server or limiting its functionality may help minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenText Content Suite Platform version 16.2.19.1803 **Description** A remote OScript execution issue was discovered, allowing an attacker to execute OScript code by passing the `htmlFile` parameter through multiple endpoints. The Content Server evaluates and executes OScript code in HTML files, enabling the attacker to manipulate files on the filesystem, create new network connections, or execute OS commands. **Recommendations** For OpenText Content Suite Platform version 16.2.19.1803, consider restricting access to the `htmlFile` parameter in the affected API endpoints until a patch is available. As a temporary workaround, disabling the execution of OScript code in HTML files could minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenText Content Suite Platform version 16.2.19.1803 **Description** An issue was discovered where the action `xmlexport` accepts the parameter `requestContext`. If this parameter is present, the response includes most of the HTTP headers sent to the server and some of the CGI variables like `remote adde` and `server name`, which is an information disclosure. **Recommendations** For OpenText Content Suite Platform version 16.2.19.1803, consider restricting access to the `xmlexport` action or removing the `requestContext` parameter to minimize the risk of information disclosure. As a temporary workaround, avoid using the `requestContext` parameter in the affected action until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OpenText Content Suite Platform version 16.2.19.1803 **Description** An issue was discovered where the request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even when the Web Admin password was not entered. This allows access to endpoints that require a valid AdminPwd cookie without knowing the password. **Recommendations** For OpenText Content Suite Platform version 16.2.19.1803, consider disabling the ll.KeepAliveSession request handler as a temporary workaround until a patch is available. Restrict access to endpoints that require a valid AdminPwd cookie to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenText Content Suite Platform version 16.2.19.1803 **Description** An issue was discovered in the Common Gateway Interface (CGI) program cs.exe, allowing an attacker to increase or decrease an arbitrary memory address by 1 and trigger a call to a method of a vftable with a vftable pointer value chosen by the attacker. **Recommendations** For OpenText Content Suite Platform version 16.2.19.1803, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OrbiTeam BSCW Classic versions prior to 5.0.12 OrbiTeam BSCW Classic versions prior to 5.1.10 OrbiTeam BSCW Classic versions prior to 5.2.4 OrbiTeam BSCW Classic versions prior to 7.3.3 OrbiTeam BSCW Classic versions prior to 7.4.3 **Description** The issue allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the `class` attribute of a `.bscw` file. **Recommendations** For versions prior to 5.0.12, update to version 5.0.12 or later. For versions prior to 5.1.10, update to version 5.1.10 or later. For versions prior to 5.2.4, update to version 5.2.4 or later. For versions prior to 7.3.3, update to version 7.3.3 or later. For versions prior to 7.4.3, update to version 7.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** OrbiTeam BSCW Classic versions prior to 5.0.12 OrbiTeam BSCW Classic versions prior to 5.1.10 OrbiTeam BSCW Classic versions prior to 5.2.4 OrbiTeam BSCW Classic versions prior to 7.3.3 OrbiTeam BSCW Classic versions prior to 7.4.3 **Description** The issue allows authenticated remote code execution (RCE) via XML tag injection. This occurs because the `reportlabplatypusparaparser.py` module, reached via `bscw.cgi` with the `op= editfolder.EditFolder` parameter, calls `eval` on attacker-supplied Python code. **Recommendations** For versions prior to 5.0.12, update to version 5.0.12 or later. For versions prior to 5.1.10, update to version 5.1.10 or later. For versions prior to 5.2.4, update to version 5.2.4 or later. For versions prior to 7.3.3, update to version 7.3.3 or later. For versions prior to 7.4.3, update to version 7.4.3 or later. As a temporary workaround, consider restricting access to the `bscw.cgi` endpoint with the `op= editfolder.EditFolder` parameter until a patch is applied.

Name of the Vulnerable Software and Affected Versions: genua genugate versions 9.0 Z before p19 genua genugate versions 9.1.x through 9.6.x before 9.6 p7 genua genugate versions 10.x before 10.1 p4 Description: An issue was discovered in the Web Interfaces of genua genugate, where a specific authentication method during login does not check the provided data and returns OK for any authentication request, allowing an attacker to login to the admin panel as a user of their choice, including the root user or even a non-existing user. This is possible due to a lack of proper validation of the provided data when a certain manipulation occurs. Recommendations: For genua genugate versions 9.0 Z before p19, update to version 9.0 Z p19 or later. For genua genugate versions 9.1.x through 9.6.x before 9.6 p7, update to version 9.6 p7 or later. For genua genugate versions 10.x before 10.1 p4, update to version 10.1 p4 or later. As a temporary workaround, consider restricting access to the Web Interfaces (Admin, Userweb, Sidechannel) until a patch is available.