Visual COBOL, COBOL Server, Enterprise…: Improper Authentication
CVE-2023-4501 is a critical-severity improper authentication vulnerability in Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server from OpenText, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 7.0.21, 8.0.10, 9.0.2 as the first without the flaw, so updating Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.76% chance of exploitation within 30 days, higher than 56% of scored CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server to 7.0.21 or 8.0.10 or 9.0.2, whichever matches your release line, or a later version.
- Update visual_cobal_cobal_server_enterprise_developer_enterprise_server to 7.0.21 or 8.0.10 or 9.0.2, whichever matches your release line, or a later version.
- Read the advisory on portal.microfocus.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| OpenText | Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server | 7.0.19 up to, but not including, 7.0.21; 8.0.8 up to, but not including, 8.0.10; 9.0.1 up to, but not including, 9.0.2 | 7.0.21, 8.0.10, 9.0.2 |
| OpenText | visual_cobal_cobal_server_enterprise_developer_enterprise_server | 7.0.19 up to, but not including, 7.0.21; 8.0.8 up to, but not including, 8.0.10; 9.0.1 up to, but not including, 9.0.2 | 7.0.21, 8.0.10, 9.0.2 |
| Micro Focus | Cobol Server | 7.0; 8.0; 9.0 | Not stated |
| Micro Focus | Enterprise Developer | 7.0; 8.0; 9.0 | Not stated |
| Micro Focus | Enterprise Server | 7.0; 8.0; 9.0 | Not stated |
| Micro Focus | Enterprise Test Server | 7.0; 8.0; 9.0 | Not stated |
| Micro Focus | Visual Cobol | 7.0; 8.0; 9.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.8 | Critical | CNA (opentext.com) |
| CVSS 3.1 | 9.8 | Critical | NVD |
Official description
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user. Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon. Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How developers prevent this class of flaw
- Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Recent Improper Authentication vulnerabilities
- 9.8 Critical severity
- 8.8 High severity
- 9.8 Critical severity
- 8.8 High severity
- 8.1 High severity
- 9.8 Critical severity
Spotted an error? Tell us.