CVE-2023-32259 - Vulnerability Details - OpenCVE

Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; and Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00047.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-36516	Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; and Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11.

Fixes

Solution

https://portal.microfocus.com/s/article/KM000018803?language=en_US

Workaround

No workaround given by the vendor.

References

Link	Providers
https://portal.microfocus.com/s/article/KM000018803?language=en_US

History

No history.

MITRE

Status: PUBLISHED

Assigner: OpenText

Published: 2024-03-19T15:54:11.630Z

Updated: 2024-08-02T15:10:23.989Z

Reserved: 2023-05-05T14:42:20.152Z

Link: CVE-2023-32259

Vulnrichment

Updated: 2024-05-23T19:01:19.052Z

NVD

Status : Awaiting Analysis

Published: 2024-03-19T16:15:07.717

Modified: 2024-11-21T08:02:59.517

Link: CVE-2023-32259

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32259", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2023-05-05T14:42:20.152Z", "datePublished": "2024-03-19T15:54:11.630Z", "dateUpdated": "2024-08-02T15:10:23.989Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Service Management Automation X (SMAX)", "vendor": "OpenText\u2122", "versions": [{"status": "affected", "version": "2020.05"}, {"status": "affected", "version": "2020.08"}, {"status": "affected", "version": "2020.11"}, {"status": "affected", "version": "2021.02"}, {"status": "affected", "version": "2021.05"}, {"status": "affected", "version": "2021.08"}, {"status": "affected", "version": "2021.11"}, {"status": "affected", "version": "2022.05"}, {"status": "affected", "version": "2022.11"}]}, {"defaultStatus": "unaffected", "product": "Asset Management X (AMX)", "vendor": "OpenText\u2122", "versions": [{"status": "affected", "version": "2021.08"}, {"status": "affected", "version": "2021.11"}, {"status": "affected", "version": "2022.05"}, {"status": "affected", "version": "2022.11"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insufficient Granularity of Access Control vulnerability in OpenText\u2122 Service Management Automation X (SMAX), OpenText\u2122 Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; and Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11.</p>"}], "value": "Insufficient Granularity of Access Control vulnerability in OpenText\u2122 Service Management Automation X (SMAX), OpenText\u2122 Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; and Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11.\n\n"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220 Insufficient Granularity of Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2024-03-19T15:54:11.630Z"}, "references": [{"url": "https://portal.microfocus.com/s/article/KM000018803?language=en_US"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<a target=\"_blank\" rel=\"nofollow\" href=\"https://portal.microfocus.com/s/article/KM000018803?language=en_US\">https://portal.microfocus.com/s/article/KM000018803?language=en_US</a><br>"}], "value": " https://portal.microfocus.com/s/article/KM000018803?language=en_US \n"}], "source": {"discovery": "UNKNOWN"}, "title": "Potential Insufficient Access Control vulnerability has been identified in OpenText\u2122 SMAX/AMX products.", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-20T15:13:38.310142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:26:24.433Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:10:23.989Z"}, "title": "CVE Program Container", "references": [{"url": "https://portal.microfocus.com/s/article/KM000018803?language=en_US", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-32259", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2023-05-05T14:42:20.152Z", "datePublished": "2024-03-19T15:54:11.630Z", "dateUpdated": "2024-06-04T17:26:24.433Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Service Management Automation X (SMAX)", "vendor": "OpenText\u2122", "versions": [{"status": "affected", "version": "2020.05"}, {"status": "affected", "version": "2020.08"}, {"status": "affected", "version": "2020.11"}, {"status": "affected", "version": "2021.02"}, {"status": "affected", "version": "2021.05"}, {"status": "affected", "version": "2021.08"}, {"status": "affected", "version": "2021.11"}, {"status": "affected", "version": "2022.05"}, {"status": "affected", "version": "2022.11"}]}, {"defaultStatus": "unaffected", "product": "Asset Management X (AMX)", "vendor": "OpenText\u2122", "versions": [{"status": "affected", "version": "2021.08"}, {"status": "affected", "version": "2021.11"}, {"status": "affected", "version": "2022.05"}, {"status": "affected", "version": "2022.11"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insufficient Granularity of Access Control vulnerability in OpenText\u2122 Service Management Automation X (SMAX), OpenText\u2122 Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; and Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11.</p>"}], "value": "Insufficient Granularity of Access Control vulnerability in OpenText\u2122 Service Management Automation X (SMAX), OpenText\u2122 Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; and Asset Management X (AMX) versions 2021.08, 2021.11, 2022.05, 2022.11.\n\n"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1220", "description": "CWE-1220 Insufficient Granularity of Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2024-03-19T15:54:11.630Z"}, "references": [{"url": "https://portal.microfocus.com/s/article/KM000018803?language=en_US"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<a target=\"_blank\" rel=\"nofollow\" href=\"https://portal.microfocus.com/s/article/KM000018803?language=en_US\">https://portal.microfocus.com/s/article/KM000018803?language=en_US</a><br>"}], "value": " https://portal.microfocus.com/s/article/KM000018803?language=en_US \n"}], "source": {"discovery": "UNKNOWN"}, "title": "Potential Insufficient Access Control vulnerability has been identified in OpenText\u2122 SMAX/AMX products.", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-32259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-20T15:13:38.310142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:19.052Z"}, "title": "CISA ADP Vulnrichment"}]}}