{"answers":{"affected":"It affects 5 products.","exploited":"There is no known exploitation of CVE-2023-4501 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2023-4501 yet. Limit exposure of the affected software until one is available.","what":"CVE-2023-4501 is a critical authentication bypass vulnerability in OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server, published on 12 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-4501 and fix it if it is affected.\n\nWhat it is: CVE-2023-4501 is a critical authentication bypass vulnerability in OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server, published on 12 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-4501 in the wild and no public exploit code.\n\nAffected product: OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-4501/ (Markdown: https://insights.sbomify.com/CVE-2023-4501/index.md)","id":"CVE-2023-4501","markdown":"https://insights.sbomify.com/CVE-2023-4501/index.md","name":"CVE-2023-4501","record":{"aliases":["GHSA-gxh2-p3fj-8cc8"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["account_takeover","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Enterprise Server","requires_auth":"none","summary":"Attackers can bypass authentication in OpenText Enterprise Server when using specific LDAP configurations, allowing them to impersonate any user.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"OpenText","cpe":[{"product":"cobol_server","vendor":"microfocus"},{"product":"enterprise_developer","vendor":"microfocus"},{"product":"enterprise_server","vendor":"microfocus"},{"product":"enterprise_test_server","vendor":"microfocus"},{"product":"visual_cobol","vendor":"microfocus"}],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-305","name":"Authentication Bypass by Primary Weakness"},{"id":"CWE-358","name":"Improperly Implemented Security Check for Standard"},{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-253","name":"Incorrect Check of Function Return Value"}],"description":"User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.\n\nMitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.\n\nAdministrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Authentication bypass in OpenText (Micro Focus) Enterprise Server","id":"CVE-2023-4501","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2023"},"n_packages":0,"n_references":1,"next":{"headline":"Translate WordPress with GTranslate \u003c 3.0.4 - Admin+ Stored XSS","id":"CVE-2023-4502"},"packages":[],"prev":{"headline":"Order Tracking Pro \u003c= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting","id":"CVE-2023-4500"},"products":["Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server"],"published":"2023-09-12","related":[{"cvss_score":7.1,"headline":"Mitigations and availability of updates relating to security vulnerability in ESCWA component CVE-2023-32265.","id":"CVE-2023-32265","kev_date_added":null,"published":"2023-07-20"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-04","vendors":["OpenText"]},"summary":"Attackers can bypass authentication in OpenText Enterprise Server when using specific LDAP configurations, allowing them to impersonate any user.","url":"https://insights.sbomify.com/CVE-2023-4501/"}