CVE-2024-10863 Client-side audit exclusion vulnerability
Attackers can manipulate client-side audit logs to exclude trails, compromising security monitoring in OpenText Secure Content Manager.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-10863?
CVE-2024-10863 is a medium-severity vulnerability in OpenText Secure Content Manager, published on 22 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
: Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This issue affects Secure Content Manager: from 10.1 before <24.4.
End-users can potentially exploit the vulnerability to exclude audit trails from being recorded on the client side.
Weakness: CWE-778
Which versions are affected by CVE-2024-10863?
How do I fix CVE-2024-10863?
No fix has been published for CVE-2024-10863 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-10863 being exploited?
There is no known exploitation of CVE-2024-10863 in the wild and no public exploit code.
Sources
Also known as GHSA-95h2-5c4f-cpvp.