Skip to content
Fencer Vulns
critical 9.8

CVE-2023-4501 json

Authentication bypass in OpenText (Micro Focus) Enterprise Server

published 2023-09-12 3 y ago modified 2026-08-04 3 mo ago also EUVD-2023-54356

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.

Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.

Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.

Patch / fix

  • OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server 7.0.21, 8.0.10, 9.0.2
  • opentext visual_cobal_cobal_server_enterprise_developer_enterprise_server 7.0.21, 8.0.10, 9.0.2

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server
  • opentext visual_cobal_cobal_server_enterprise_developer_enterprise_server

Classification

Weakness
  • CWE-287 Improper Authentication
  • CWE-305 Authentication Bypass by Primary Weakness
  • CWE-358 Improperly Implemented Security Check for Standard
  • CWE-253 Incorrect Check of Function Return Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.