HTML injection in OpenText Opentext Directory Services Swagger UI

A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2.

• OpenText Opentext Directory Services, OTDS Swagger UI: The CNA structured affected data marks the custom range from version 0 through and including 22.2 as affected.
• The default status is recorded as unaffected outside the declared affected set, but that value should not be used to assume that every unverified later or parallel branch is safe.
• The record does not provide an exact fixed release. The patch_available flag does not identify a target version or establish that all parallel and later release branches are fixed.

The confirmed weakness is improper neutralization of input during web page generation, classified as CWE-79. In the OTDS Swagger UI, attacker-controlled data may be interpreted as HTML instead of being rendered only as ordinary data, consistent with the CNA's HTML injection title. The public record does not identify the exact request field, parameter, endpoint, or rendering path, so those implementation details remain unknown. The supplied vector indicates that the attack can be reached over the network, requires no privileges, and has low complexity; user interaction is recorded as passive, meaning a victim browser or viewing context is involved. The available evidence does not confirm server-side code execution or a specific payload.

• Reachability: Network.
• Authentication and privileges: No privileges are required according to the supplied data.
• Complexity: Low.
• User interaction: Recorded as passive, indicating that a victim's browser or viewing context may be part of the attack path.
• Known exploitation: The record sets public_exploit to false and known_exploited to null. Related enrichment records exploitation as none, so active exploitation is not confirmed. The availability of a usable public exploit should still be treated as unconfirmed.

The vulnerability may allow content to be inserted into the OTDS Swagger UI web-page context and affect data that a user can view or modify in the browser session. The record's assessment indicates potentially high confidentiality and integrity impact, while availability impact is not indicated. The concrete outcome depends on the data and functions available to the user session. The record does not establish privilege escalation, server takeover, service disruption, or impact beyond the affected system.

The vulnerability can undermine trust in the Swagger UI and affect the confidentiality or integrity of data displayed in a user's web session. If the interface is exposed and malicious content is rendered in a victim's browser, the organization may need to review data or actions associated with the relevant sessions. Response work may include urgent inventory, system updates, and access restrictions for the affected administrative or API documentation interface. The record does not identify a specific breach, victim, campaign, or data exposure event.

1. Apply the official OpenText security update or remediation guidance associated with knowledge article KB0870915. The record does not provide an exact fixed release, so verify the correct update for the product branch in use.
2. Prioritize upgrading every installation within the range from version 0 through and including 22.2, then verify the installed build and remediation status.
3. Until updating is complete, restrict network access to OTDS Swagger UI as operationally appropriate, especially from untrusted networks or users. This is a precautionary exposure-reduction measure, not a vendor-confirmed workaround.
4. If the interface was exposed, review relevant sessions and data to assess whether malicious content may have been rendered. Do not treat the absence of suspicious evidence as proof that the system was unaffected.

1. Inventory all systems running OpenText Opentext Directory Services and record the actual installed build.
2. Identify deployments that include OTDS Swagger UI and determine whether the interface is reachable from untrusted networks or without authentication.
3. Compare each installation with the affected version range and OpenText update status; do not infer safety merely because the service remains operational.
4. As a precautionary monitoring measure, review access and application logs associated with Swagger UI for unusual requests or input containing markup or script content. This is not a vendor-confirmed indicator of compromise, and the absence of suspicious log entries does not prove that a system is safe.