CVE-2023-32266 - CVE House

Back to Database

Status published Medium CVE-2023-32266

Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.

5.3 CVSS

Vulnerability Description

Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32266

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Vaibhav Srivastava (eSecForte Technologies Pvt. Ltd.)

References

https://portal.microfocus.com/s/article/KM000024386?language=en_US

More from OpenText™

View All →

Stored-XSS vulnerability discovered in OpenText WSM Management Server.

RCE vulnerability has been discovered in OpenText™ Carbonite Safe Server Backup.

SSRF vulnerability have been discovered in OpenText™ XM Fax

Path Traversal vulnerability have been discovered in OpenText™ XM Fax.

Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability...

Affected Vendor

OpenText™

View all reports →

Affected Software

Application Lifecycle Management (ALM),Quality Center

Vulnerable Versions:

15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1

Timeline

Official Publish: October 16th, 2024

Last Modified: October 16th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1574 Hijack Execution Flow

Privilege Escalation

T1036 Masquerading

Defense Evasion

T1543 Create or Modify System Process

T1059 Command and Scripting Interpreter

T1569 System Services