CVE-2023-4551 is a high severity (CVSS 7.2) OS command injection in the Scheduler of OpenText AppBuilder, from version 21.2 before 23.2, on Windows and Linux. Authenticated users can inject operating system commands. Upgrade to 23.2 or later and review who can create scheduled tasks.
What's affected
The NVD record says improper input validation in AppBuilder allows OS command injection. The Scheduler, which creates scheduled tasks, is vulnerable, and authenticated users can inject arbitrary operating system commands into the executing process.
The affected range is 21.2 before 23.2, on Windows and Linux. The record lists an OpenText knowledge base article as its only reference. That page needs a browser session and could not be read automatically, so confirm the fixed release and any hotfix for older streams there.
It belongs to a set of three AppBuilder CVEs published on the same day, together with CVE-2023-4550 (file read) and CVE-2023-4552 (database feature abuse). One upgrade closes all of them.
How to check if you're exposed
Confirm the AppBuilder version in the product or your installation notes. Versions from 21.2 up to, but not including, 23.2 are in scope.
List the accounts that may create or edit scheduled tasks. The record requires an authenticated user, and the score is lower than a no login bug for that reason.
Review existing scheduled tasks for entries you do not recognise, and for command lines with unexpected content.
Check which operating system account runs the AppBuilder service, because injected commands run with that account rights.
What to do now
- Upgrade AppBuilder to 23.2 or later.
- Review and prune the list of users who can use the Scheduler.
- Audit existing scheduled tasks and remove ones you cannot explain.
- Run the AppBuilder service as a low privilege account.
- Monitor process creation on the host for shells started by the service.
Why it matters
The record maps this to CWE-20, improper input validation. Text typed into a task definition is passed on to the operating system without being treated as data, so special characters can change what runs.
Authenticated command injection is often underrated. Any account that can reach the feature becomes a path to the server, so stolen or shared credentials matter more than the score suggests. Applications that schedule jobs often run them under a service account with wide access, which is why limiting that account matters as much as the patch. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Why is this lower than the file read issue?
The record says it needs an authenticated user, while the file read can be reached without authentication, which gives it a higher score of 7.5 versus 7.2.
Sources
Last reviewed: 19 October 2026.
