The vulnerability is an open redirect flaw that allows an attacker to embed a malicious link within a specially crafted URL. When a legitimate user follows that link, the system redirects them to the attacker's target site, enabling phishing, drive‑by downloads, or credential theft through social engineering. This flaw does not directly grant code execution or arbitrary system access, but it can compromise user safety via redirect-based attacks.

The flaw resides solely in the classic, non‑containerized deployment of the UCMDB Browser UI (ucmdb-browser) component used by OpenText Universal Discovery & CMDB and Operations Bridge Manager. Containerized deployment options are unaffected. Product versions containing the legacy ucmdb-browser component are impacted, though specific version ranges are not enumerated in the available data.

The CVSS score of 5.1 indicates moderate severity. EPSS data is missing, so exploitation likelihood is unknown, and the flaw is not listed in CISA KEV, suggesting no widespread exploitation has been reported. The attack requires a victim to click the compromised link, making it a human‑interaction, social‑engineering vector rather than an automated attack opportunity.