CVE-2022-35898
📋 TL;DR
CVE-2022-35898 is an authentication bypass vulnerability in OpenText BizManager that allows any authenticated user to change passwords for any other user, including administrative accounts. This affects all OpenText BizManager installations before version 16.6.0.1. The vulnerability stems from improper validation during password change operations.
💻 Affected Systems
- OpenText BizManager
📦 What is this software?
Bizmanager by Opentext
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where an attacker gains administrative privileges, leading to data theft, system manipulation, or ransomware deployment.
Likely Case
Privilege escalation allowing attackers to access sensitive business data, modify configurations, or disrupt B2B operations.
If Mitigated
Limited impact if strong network segmentation, monitoring, and least privilege principles are already implemented.
🎯 Exploit Status
Exploitation requires any valid user credentials. The vulnerability is simple to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.6.0.1 and later
Vendor Advisory: https://businessnetwork.opentext.com/b2b-gateway/
Restart Required: Yes
Instructions:
1. Download OpenText BizManager version 16.6.0.1 or later from official sources. 2. Backup current configuration and data. 3. Apply the update following OpenText's upgrade documentation. 4. Restart the BizManager service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to BizManager to only trusted networks and users
Enhanced Monitoring
allMonitor for unusual password change activities in audit logs
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the BizManager interface
- Enable detailed logging of all authentication and password change events and monitor them closely
🔍 How to Verify
Check if Vulnerable:
Check the BizManager version in the administration console or configuration files. If version is below 16.6.0.1, the system is vulnerable.Check Version:
Check the administration console or refer to installation documentation for version verification methods.Verify Fix Applied:
After patching, verify the version shows 16.6.0.1 or higher. Test password change functionality with non-admin users to ensure they cannot change other users' passwords.📡 Detection & Monitoring
Log Indicators:
- Unusual password change events, especially from non-admin users changing admin passwords
- Multiple failed login attempts followed by successful password changes
Network Indicators:
- Unusual authentication patterns to BizManager endpoints
- Traffic from unexpected sources to password change APIs
SIEM Query:
source="bizmanager" AND (event_type="password_change" AND user_role!="admin")