CVE-2024-12862— REST API allows users without permissions to remove external collaborators
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-12862
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
REST API allows users without permissions to remove external collaborators
Source: NVD (National Vulnerability Database)
Vulnerability Description
Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove external collaborators.This issue affects Content Server: 20.2-24.4.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
OpenText Content Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenText Content Server是加拿大OpenText公司的一个企业内容管理软件。 OpenText Content Server 20.2版本至24.4版本存在安全漏洞，该漏洞源于REST API授权不当，可能导致无权限用户删除外部协作者。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenText | Content Server | 20.2-24.4 | - |
II. Public POCs for CVE-2024-12862
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-12862
请登录查看更多情报信息。
Same Patch Batch · OpenText · 2025-04-21 · 4 CVEs total
| CVE-2024-12543 | A user enumeration and subsequent data integrity vulnerability affecting barcode functiona | |
| CVE-2024-12863 | Stored XSS in Discussions functionality | |
| CVE-2025-2517 | Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manage |
IV. Related Vulnerabilities
Same vendor: OpenText
- CVE-2026-2123
Privilege escalation vulnerability in Operations Agent - CVE-2024-11604
Insertion of Sensitive Information into Log File - CVE-2025-13478
Cache Misconfiguration Leading to Cross-User Data Exposure - CVE-2025-8050
External Control of File vulnerability has been discovered i - CVE-2025-8052
HQL Injection vulnerability has been discovered in Opentext
Same weakness: CWE-863
- CVE-2025-10908
Account Lock Bypass via Magic Link or Pass Key Authenticatio - CVE-2026-42571
Privilege Escalation Attack affecting Pelican Web UI - CVE-2025-15633
HCL BigFix WebUI is affected by an improper authorization vu - CVE-2026-42296
Argo Workflows has incomplete fix for CVE-2026-31892: hostNe - CVE-2025-66170
Apache CloudStack: Any user can list backups that they shoul
V. Comments for CVE-2024-12862
No comments yet