Content Management
Monthly
Cross-site scripting in the Forums feature of OpenText Content Management (Content Server) allows an unauthenticated remote attacker to inject malicious script into a Forums web page, which then executes in the browser session of any user who views that page. The affected deployments are those running Content Server with the Forums feature enabled and reachable by untrusted users; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms no authentication is required to attempt injection, and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) confirms that a victim must view the poisoned page and that impact is confined to that victim's browser session rather than the server. Rated 5.3 medium severity under CWE-79, with no public exploit identified at time of analysis.
Cross-site scripting in the Forums feature of OpenText Content Management (Content Server) allows an unauthenticated remote attacker to inject malicious script into a Forums web page, which then executes in the browser session of any user who views that page. The affected deployments are those running Content Server with the Forums feature enabled and reachable by untrusted users; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms no authentication is required to attempt injection, and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) confirms that a victim must view the poisoned page and that impact is confined to that victim's browser session rather than the server. Rated 5.3 medium severity under CWE-79, with no public exploit identified at time of analysis.