Authentication bypass in OpenText (Micro Focus) Enterprise Server
Priority MEDIUM 50CWE-253Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user. Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon. Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00758 55th percentileScored 2026-11-07
Fix Fixed Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server (OpenText): 7.0.21, 8.0.10, 9.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenText | Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server | 7.0.19 to before 7.0.21; 8.0.8 to before 8.0.10; 9.0.1 to before 9.0.2 | 7.0.21, 8.0.10, 9.0.2 | Patch available | CNA |
- Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server VendorOpenText Affected 7.0.19 to before 7.0.21; 8.0.8 to before 8.0.10; 9.0.1 to before 9.0.2 Fixed in 7.0.21, 8.0.10, 9.0.2 Patch available CNA
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:cobol_server:7.0:patch_update_19:*:*:*:*:*:* | 7.0 patch_update_19 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:cobol_server:7.0:patch_update_20:*:*:*:*:*:* | 7.0 patch_update_20 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:cobol_server:8.0:patch_update_8:*:*:*:*:*:* | 8.0 patch_update_8 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:cobol_server:8.0:patch_update_9:*:*:*:*:*:* | 8.0 patch_update_9 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:cobol_server:9.0:patch_update_1:*:*:*:*:*:* | 9.0 patch_update_1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_developer:7.0:patch_update_19:*:*:*:*:*:* | 7.0 patch_update_19 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_developer:7.0:patch_update_20:*:*:*:*:*:* | 7.0 patch_update_20 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_developer:8.0:patch_update_8:*:*:*:*:*:* | 8.0 patch_update_8 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_developer:8.0:patch_update_9:*:*:*:*:*:* | 8.0 patch_update_9 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_developer:9.0:patch_update_1:*:*:*:*:*:* | 9.0 patch_update_1 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:cobol_server:7.0:patch_update_19:*:*:*:*:*:* Versions 7.0 patch_update_19 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:cobol_server:7.0:patch_update_20:*:*:*:*:*:* Versions 7.0 patch_update_20 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:cobol_server:8.0:patch_update_8:*:*:*:*:*:* Versions 8.0 patch_update_8 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:cobol_server:8.0:patch_update_9:*:*:*:*:*:* Versions 8.0 patch_update_9 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:cobol_server:9.0:patch_update_1:*:*:*:*:*:* Versions 9.0 patch_update_1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_developer:7.0:patch_update_19:*:*:*:*:*:* Versions 7.0 patch_update_19 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_developer:7.0:patch_update_20:*:*:*:*:*:* Versions 7.0 patch_update_20 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_developer:8.0:patch_update_8:*:*:*:*:*:* Versions 8.0 patch_update_8 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_developer:8.0:patch_update_9:*:*:*:*:*:* Versions 8.0 patch_update_9 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_developer:9.0:patch_update_1:*:*:*:*:*:* Versions 9.0 patch_update_1 Vulnerable ·Micro Focus International
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:enterprise_server:7.0:patch_update_19:*:*:*:*:*:* | 7.0 patch_update_19 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_server:7.0:patch_update_20:*:*:*:*:*:* | 7.0 patch_update_20 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_server:8.0:patch_update_8:*:*:*:*:*:* | 8.0 patch_update_8 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_server:8.0:patch_update_9:*:*:*:*:*:* | 8.0 patch_update_9 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_server:9.0:patch_update_1:*:*:*:*:*:* | 9.0 patch_update_1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_test_server:7.0:patch_update_19:*:*:*:*:*:* | 7.0 patch_update_19 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_test_server:7.0:patch_update_20:*:*:*:*:*:* | 7.0 patch_update_20 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_test_server:8.0:patch_update_8:*:*:*:*:*:* | 8.0 patch_update_8 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_test_server:8.0:patch_update_9:*:*:*:*:*:* | 8.0 patch_update_9 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:enterprise_test_server:9.0:patch_update_1:*:*:*:*:*:* | 9.0 patch_update_1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:visual_cobol:7.0:patch_update_19:*:*:*:*:*:* | 7.0 patch_update_19 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:visual_cobol:7.0:patch_update_20:*:*:*:*:*:* | 7.0 patch_update_20 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:visual_cobol:8.0:patch_update_8:*:*:*:*:*:* | 8.0 patch_update_8 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:visual_cobol:8.0:patch_update_9:*:*:*:*:*:* | 8.0 patch_update_9 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:visual_cobol:9.0:patch_update_1:*:*:*:*:*:* | 9.0 patch_update_1 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:enterprise_server:7.0:patch_update_19:*:*:*:*:*:* Versions 7.0 patch_update_19 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_server:7.0:patch_update_20:*:*:*:*:*:* Versions 7.0 patch_update_20 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_server:8.0:patch_update_8:*:*:*:*:*:* Versions 8.0 patch_update_8 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_server:8.0:patch_update_9:*:*:*:*:*:* Versions 8.0 patch_update_9 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_server:9.0:patch_update_1:*:*:*:*:*:* Versions 9.0 patch_update_1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_test_server:7.0:patch_update_19:*:*:*:*:*:* Versions 7.0 patch_update_19 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_test_server:7.0:patch_update_20:*:*:*:*:*:* Versions 7.0 patch_update_20 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_test_server:8.0:patch_update_8:*:*:*:*:*:* Versions 8.0 patch_update_8 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_test_server:8.0:patch_update_9:*:*:*:*:*:* Versions 8.0 patch_update_9 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:enterprise_test_server:9.0:patch_update_1:*:*:*:*:*:* Versions 9.0 patch_update_1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:visual_cobol:7.0:patch_update_19:*:*:*:*:*:* Versions 7.0 patch_update_19 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:visual_cobol:7.0:patch_update_20:*:*:*:*:*:* Versions 7.0 patch_update_20 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:visual_cobol:8.0:patch_update_8:*:*:*:*:*:* Versions 8.0 patch_update_8 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:visual_cobol:8.0:patch_update_9:*:*:*:*:*:* Versions 8.0 patch_update_9 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:visual_cobol:9.0:patch_update_1:*:*:*:*:*:* Versions 9.0 patch_update_1 Vulnerable ·Micro Focus International
Remediation
- Fix · CNA Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server (OpenText) Fixed in 7.0.21, 8.0.10, 9.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4501
- 2026-10-03 Alias added: GHSA-gxh2-p3fj-8cc8
References
More OpenText vulnerabilities
- TI-2022-22711 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
- TI-2022-22712 A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1… CVSS 3.1HIGH 8.8
- TI-2022-22710 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
- TI-2022-22707 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
- TI-2022-22706 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 8.8
- TI-2022-22709 An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). CVSS 3.1HIGH 7.5
Sources
- CVE-2023-4501 · CVE Program
- CVE-2023-4501 · NVD
- FIRST EPSS
- GHSA-gxh2-p3fj-8cc8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences