EUVD-2025-211030
GHSA-9h58-c628-h5cr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Forums feature over network
-
DeliverySubmit post with malicious script
-
ExploitPayload stored/reflected in Forums page
-
ExecutionVictim user opens the page
-
ImpactScript executes in victim browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Forums feature of OpenText Content Management (Content Server) to be enabled and reachable, and a victim user must actively view the attacker-poisoned Forums web page (UI:P) for the injected script to execute - it is not a drive-by against the server itself. The vendor's PR:N rating indicates no authentication is required to inject, though in practice posting to a forum often requires an account, so the real limiting factor is whether anonymous forum posting is permitted in the deployment plus the requirement for victim interaction; impact is confined to the victim's browser session. |
| Impact | This is a medium-severity stored/reflected Cross-site Scripting flaw (CWE-79) in the Forums feature of OpenText Content Management (Content Server). The only CVSS vector provided is CVSS:4.0 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N), scored 5.3. Network vector with low complexity and no privileges (PR:N) means remote unauthenticated reach, but exploitation is gated by passive user interaction (UI:P) - a victim must load the poisoned Forums page. Impact is limited to low confidentiality (VC:L) with no integrity or availability impact per the vendor, which caps real-world severity. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code referenced in the provided data, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Overall this reads as a genuine but moderate web-application bug rather than an urgent priority: the absence of KEV/EPSS/POC signals combined with required user interaction and low-only impact argues for routine patch prioritization. Note a tension worth verifying: injecting content into a Forums page typically implies the attacker must post to the forum (often an authenticated action), yet the vendor rated PR:N - confirm with OpenText whether unauthenticated forum posting is possible in default deployments. |
| Exploit ScenarioDerived | An attacker submits a crafted forum post or field containing malicious JavaScript into the OpenText Content Management Forums feature; the payload is rendered unsanitized when another user views the Forums web page, executing in that victim's browser session. No public exploit code is referenced, and successful attack requires a victim to actually open the malicious page (UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Cross-site scripting in the Forums feature of OpenText Content Management (Content Server) allows an unauthenticated remote attacker to inject malicious script into a Forums web page, which then executes in the browser session of any user who views that page. The affected deployments are those running Content Server with the Forums feature enabled and reachable by untrusted users; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms no authentication is required to attempt injection, and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) confirms that a victim must view the poisoned page and that impact is confined to that victim's browser session rather than the server. Rated 5.3 medium severity under CWE-79, with no public exploit identified at time of analysis.
RemediationAI
No exact fix version is specified in the available data, so the primary action is to obtain the current patched Content Server build through OpenText support and consult the vendor advisory at https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0874468 to determine which release lines carry the Forums XSS fix; patch status should be treated as vendor-advisory-dependent rather than assumed. Until a fixed build is applied, the highest-value compensating control is to disable the Forums feature entirely if it is not required, since this removes the injection surface - the trade-off being loss of collaboration functionality for users who rely on it. If Forums must remain available, disable anonymous and guest posting and require authenticated accounts to post, which does not eliminate the flaw but sharply reduces the pool of attackers who can plant a payload and creates an audit trail; expect reduced community engagement as a side effect. Additional layers include deploying a WAF rule set tuned to forum POST parameters, and enforcing a restrictive Content Security Policy on Content Server pages to limit script execution, though CSP can break legitimate in-page scripts and requires testing before enforcement. Because exploitation depends on a victim viewing a poisoned forum page, user-side defenses such as browser extensions or mail/web gateway filtering provide only marginal benefit and should not be relied upon as the primary mitigation, and no public exploit code is known at time of analysis, so prioritized patching rather than emergency containment is appropriate for a 5.3-severity issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-79 improper-neutralization-during-web-page-generation flaw in the Forums component of OpenText Content Server, an enterprise content management platform. User-supplied forum content is rendered back to other users without adequate output encoding or input sanitization, so attacker-controlled markup and script survive into the generated HTML and execute under the Content Server origin in the victim's browser. Because the payload is persisted in a forum page and served to later viewers, the behavior is consistent with a stored (persistent) XSS pattern, though the advisory describes it generically as XSS in the Forums feature. The CPE string cpe:2.3:a:opentext:content_management:*:*:*:*:*:*:*:* uses a wildcard version, indicating the vendor did not enumerate specific affected releases in the available data; the practical exposure boundary is therefore the presence and reachability of the Forums feature and whether untrusted or anonymous users can post to it. The CVSS 4.0 vector's UI:P versus the independent 3.1 vector's UI:R/S:C reflects the same underlying exposure viewed through different scoring models: victim browsing is required, and the blast radius is the victim's browser context with low confidentiality and integrity impact rather than server compromise.
Know when Content Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable XSS needing victim interaction (UI:R); script executing in the victim browser crosses a trust boundary (S:C) with low confidentiality and integrity impact and no availability effect.
Primary rating from Vendor (OpenText).
CVSS VectorVendor: OpenText
DescriptionCVE.org
Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB