Description

An Open Redirect vulnerability has been identified in OpenText™ Universal Discovery and CMDB. The vulnerability can be exploited only if an attacker sends a specially crafted URL containing a link to a malicious resource and a user subsequently follows that link. Affected systems: This issue affects only the classic deployment options for UCMDB UI (ucmdb-browser) component within Universal Discovery and CMDB and Operations Bridge Manager. Containerized deployment options are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-05T20:17:55.600Z",
  "pubdate": "2026-11-05T20:17:55.600Z",
  "executiveSummary": "An Open Redirect vulnerability has been identified within the ucmdb-browser component of OpenText Universal Discovery, CMDB, and Operations Bridge Manager. This security flaw stems from improper validation of user-supplied input used in redirection parameters.\nThe vulnerability allows an unauthenticated or authenticated attacker to craft a malicious URL that, when accessed by a legitimate user, redirects the victim to an arbitrary external domain. This mechanism facilitates phishing campaigns, credential harvesting, and the bypass of security controls that rely on domain validation.\nExploitation requires the victim to interact with the crafted link; the threat actor cannot trigger the redirect unilaterally. The scope of impact is limited to the classic deployment architecture of the specified products, with containerized deployments remaining unaffected. Due to the potential for social engineering and redirection to malicious infrastructure, organizations should treat this vulnerability with moderate urgency, focusing on user awareness and the application of vendor-supplied patches once available.",
  "technicalDetails": "The vulnerability resides in the application's handling of HTTP redirect parameters within the ucmdb-browser component. In standard web application architecture, an Open Redirect occurs when an application accepts a user-controlled input (often via a query parameter such as 'url', 'next', or 'redirect') to determine the destination of an HTTP 3xx response without performing whitelist-based validation or domain scoping.\nIn the context of Universal Discovery and CMDB, the application fails to adequately sanitize or validate the target destination provided in the URL parameters. Consequently, an attacker can manipulate these parameters to point to a URL of their choosing. The attack flow initiates when the attacker generates a link containing the base URL of the vulnerable UCMDB instance, appended with a manipulated redirect parameter pointing to a malicious, attacker-controlled domain.\nWhen a victim, who may be authenticated within the trusted UCMDB environment, clicks the link, the application processes the parameter and issues an HTTP redirect instruction to the client browser. Because the browser perceives the initial request as originating from a trusted domain, it may automatically follow the redirect to the malicious destination. This technique effectively masks the malicious intent, as the initial portion of the URL aligns with the trusted organization's infrastructure.\nThe post-exploitation impact includes the successful delivery of users to phishing sites designed to capture session tokens, administrative credentials, or sensitive organizational data. Furthermore, by redirecting users to a malicious site, an attacker may facilitate drive-by downloads or exploit client-side vulnerabilities in the browser. The vulnerability affects the classic deployment model of the ucmdb-browser, where the underlying application logic does not enforce strict origin checks on outbound redirections. There are no known privilege requirements for the initial triggering of the redirect; however, the success of subsequent malicious activity may depend on the session state of the victim in relation to the UCMDB environment."
}