CVE-2025-0884 - Vulnerability Details - OpenCVE

Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation. This issue affects Service Manager: 9.70, 9.71, 9.72.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://portal.microfocus.com/s/article/KM000036731?language=en_US

History

Wed, 12 Mar 2025 15:30:00 +0000

Type	Values Removed	Values Added
Description		Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation. This issue affects Service Manager: 9.70, 9.71, 9.72.
Title		Privilege Escalation vulnerability has been discovered in OpenText™ Service Manager.
Weaknesses		CWE-428
References		https://portal.microfocus.com/s/article/KM000036731?language=en_US
Metrics		cvssV4_0 `{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:N/R:A/V:C/RE:M/U:Green'}`

MITRE

Status: PUBLISHED

Assigner: OpenText

Published: 2025-03-12T15:24:31.859Z

Updated: 2025-03-12T15:24:31.859Z

Reserved: 2025-01-30T15:23:21.964Z

Link: CVE-2025-0884

Vulnrichment

No data.

NVD

Status : Received

Published: 2025-03-12T16:15:20.523

Modified: 2025-03-12T16:15:20.523

Link: CVE-2025-0884

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-0884", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2025-01-30T15:23:21.964Z", "datePublished": "2025-03-12T15:24:31.859Z", "dateUpdated": "2025-03-12T15:24:31.859Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Service Manager", "vendor": "OpenText\u2122", "versions": [{"status": "affected", "version": "9.70"}, {"status": "affected", "version": "9.71"}, {"status": "affected", "version": "9.72"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unquoted Search Path or Element vulnerability in OpenText\u2122 Service Manager. \n\nThe vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation.\n\n<p>This issue affects Service Manager: 9.70, 9.71, 9.72.</p>"}], "value": "Unquoted Search Path or Element vulnerability in OpenText\u2122 Service Manager.\u00a0\n\nThe vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation.\n\nThis issue affects Service Manager: 9.70, 9.71, 9.72."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "AUTOMATIC", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.3, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "GREEN", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:N/R:A/V:C/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-428", "description": "CWE-428 Unquoted Search Path or Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2025-03-12T15:24:31.859Z"}, "references": [{"url": "https://portal.microfocus.com/s/article/KM000036731?language=en_US"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<a target=\"_blank\" rel=\"nofollow\" href=\"https://portal.microfocus.com/s/article/KM000036731?language=en_US\">OpenText\u2122 Service Manager (SM) Security Bulletin - Unquoted Service Path Enumeration</a>\n\n<br>"}], "value": "OpenText\u2122 Service Manager (SM) Security Bulletin - Unquoted Service Path Enumeration https://portal.microfocus.com/s/article/KM000036731"}], "source": {"discovery": "UNKNOWN"}, "title": "Privilege Escalation vulnerability has been discovered in OpenText\u2122 Service Manager.", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}