CVE-2024-1148 CRITICAL

CVE-2024-1148: Weak Access Control - Arbitrary file upload

Vendor Opentext
Product PVCS Version Manager
Weakness CWE-287 · Improper authentication
Published March 21, 2024
Last update November 11, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and uploading of files.

Key dates

02Disclosure timeline

March 21, 2024 CVE published
November 11, 2024 Record updated