CVE-2024-7085 HIGH

CVE-2024-7085: Exposure of private information vulnerability has been discovered in OpenText™ Solutions Business Manager (SBM).

Vendor Opentext™

Product Solutions Business Manager (SBM)

Weakness CWE-79 · XSS

Published January 15, 2025

Last update January 15, 2025

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:N/R:A/V:C/RE:M/U:Red

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Solutions Business Manager (SBM) allows Stored XSS. The vulnerability could result in the exposure of private information to an unauthorized actor. This issue affects Solutions Business Manager (SBM): through 12.2.1.

Key dates

02Disclosure timeline

January 15, 2025 CVE published

January 15, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-7085 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-64999 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVE-2025-13843 VigLink SpotLight By ShortCode <= 1.0.a - Authenticated (Contributor+) Stored Cross-Site Scripting via 'float' Shortcode Attribute CVE-2025-47477 WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2021-36844 WordPress WP Subscribe plugin <= 1.2.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2024-35675 WordPress Advanced Woo Labels plugin <= 1.93 - Cross Site Scripting (XSS) vulnerability