Security alert - CVE-2024-10863: Audit log vulnerability affects OpenText Secure Content Manager

Graeme Christieson OpenText Employee

1 Likes

18 days ago

Security alert

Client-side audit exclusion vulnerability in OpenText Secure Content Manager

Systems Affected:

OpenText Secure Content Manager 24.3 and older versions

Details:

CVE-2024-10863: Audit log vulnerability affects OpenText Secure Content Manager

End-users can potentially exploit the vulnerability to exclude audit trails from being recorded on the client side.

Impact:

If users exploit the vulnerability, client-side events will not be captured in the central audit log.

For more details click here

Labels:

Support Tips/Knowledge Docs

Comment List

Top Comments

[Scotty] 😬 15 days ago in reply to Graeme Christieson

Hi Graeme,

Another question from a client - wondering if there are any mitigation steps for anyone who can't quickly apply the patch?

Much thanks in advance,
Scotty
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
Graeme Christieson 18 days ago in reply to [Scotty] 😬

Feedback from CPE.

Does client-side mean 'any client application' e.g. Web Client / Mobile App / Desktop?

No, this applies only to the CM Desktop application

Does 'central audit log' mean both the Online and Offline Audit Log?

No, this is only for the Online Audit log

Do we know a CVE rating, and is there going to be a hotfix or the only way to remediate the CVE is to apply the patch?

Yes, it scored 5.1(medium CVSS scoring), no hotfix will be provided, the only way is to apply patches.

Regards

Graeme Christieson

Lead Technical Support Specialist

Global Technical Support

QLD, Australia
- Cancel
- Vote Up +1 Vote Down
- Sign in to reply
- More
- Cancel
Graeme Christieson 18 days ago in reply to [Scotty] 😬

Hi Scotty,

I will pass these questions onto CPE and let me provide an official answer.

Regards

Graeme Christieson

Lead Technical Support Specialist

Global Technical Support

QLD, Australia
- Cancel
- Vote Up +1 Vote Down
- Sign in to reply
- More
- Cancel
[Scotty] 😬 18 days ago in reply to [Scotty] 😬

An additional set of questions

Does client side mean 'any client application' e.g. Web Client / Mobile App / Desktop?

Does 'central audit log' mean both the Online and Offline Audit Log?

Much thanks in advance.

-Scotty
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel
[Scotty] 😬 18 days ago

Hi Graeme,

Two quick questions for this one - do we know a CVE rating, and is there going to be a hotfix or the only way to remediate the CVE is to apply the patch?

-Scotty
- Cancel
- Vote Up 0 Vote Down
- Sign in to reply
- More
- Cancel

Recommended

Menu

Content Manager Tips

Security alert - CVE-2024-10863: Audit log vulnerability affects OpenText Secure Content Manager

Labels:

Top Comments

Resources