Auth bypass in Microfocus Cobol_server
CVE-2023-4501
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versio…
EPSS: 0.006 (45.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Microfocus Cobol_server — versions 7.0, 8.0, 9.0
- Microfocus Enterprise_developer — versions 7.0, 8.0, 9.0
- Microfocus Enterprise_server — versions 7.0, 8.0, 9.0
- Microfocus Enterprise_test_server — versions 7.0, 8.0, 9.0
- Microfocus Visual_cobol — versions 7.0, 8.0, 9.0
- Opentext Visual Cobol, Cobol Server, Enterprise Developer, Server — versions 7.0.19, 8.0.8, 9.0.1
Weakness classification (CWE)
References
- security@opentext.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-4501?
- CVE-2023-4501 is a critical-severity vulnerability in Microfocus Cobol_server, classified under CWE-253. CVSS score: 9.8/10. Published 2023-09-12.
- How severe is CVE-2023-4501?
- Critical severity. CVSS v3 base score is 9.8 out of 10.