CVE-2023-24466 Possible XML External Entity Injection in OpenText iManager
An attacker can exploit XML External Entity injection in OpenText iManager to read sensitive files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-24466?
CVE-2023-24466 is a high-severity vulnerability in OpenText iManager, published on 22 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Possible XML External Entity Injection
in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200.
Weakness: CWE-611
Which versions are affected by CVE-2023-24466?
It affects 1 product.
Products include Microfocus Imanager.
How do I fix CVE-2023-24466?
No fix has been published for CVE-2023-24466 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-24466 being exploited?
There is no known exploitation of CVE-2023-24466 in the wild and no public exploit code.
Other vulnerabilities in OpenText iManager
- CVE-2021-38116 Possible Command injection Vulnerability in OpenText iManager
- CVE-2021-38117 Possible Remote Code Execution Vulnerability OpenText iManager
- CVE-2023-24467 Possible Command Injection in OpenText iManager
- CVE-2021-38135 Possible External service interaction Vulnerability in OpenText iManager
- CVE-2024-3969 XML External Entity injection vulnerability in iManager
Sources
Also known as GHSA-3vp6-4284-wj7c.