CVE-2023-4552 is a medium severity (CVSS 5.5) improper input validation flaw in OpenText AppBuilder, from version 21.2 before 23.2. An authenticated user who can create or manage databases can reach the server file system. Upgrade to 23.2 or later and review who holds database management rights.
What's affected
The NVD record says improper input validation in OpenText AppBuilder on Windows and Linux allows probing of system files. An authenticated user with the ability to create or manage existing databases can use them to exploit the AppBuilder server, including access to its local file system.
The range is AppBuilder from 21.2 before 23.2. The record gives an OpenText knowledge base article as its only reference. That page needs a browser session and could not be read automatically, so check it for platform notes and fixes for older streams.
The score is lower than its two siblings, CVE-2023-4550 and CVE-2023-4551, because the user needs an account with database management rights.
How to check if you're exposed
Confirm the AppBuilder version. Versions from 21.2 up to, but not including, 23.2 are in scope.
List which accounts can create or manage databases inside AppBuilder. This is a more limited group than all users, and it is the group that matters for this CVE.
Review the databases that exist and look for ones that point at unusual locations or that nobody remembers creating.
Check the file system rights of the service account, since access to the local file system is bounded by them.
What to do now
- Upgrade AppBuilder to 23.2 or later.
- Reduce the number of accounts that can create or manage databases.
- Review existing databases and remove unknown entries.
- Run the service under a limited operating system account.
- Review audit logs for database creation events by accounts that do not usually do that.
Why it matters
The record maps this to CWE-20, improper input validation. A feature built to manage databases accepts input that reaches beyond its intended boundary and touches the host file system.
This is a privilege boundary issue. A role that should only manage application data ends up with reach into the server. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. Review application roles often, because feature specific rights tend to spread over time. Ask who really needs to manage databases, and remove the right from everyone else, since the fewer accounts that hold it, the fewer credentials an attacker can target.
Quick check
Is this the same as the file read in CVE-2023-4550?
No. That one can be reached by unauthenticated users. This one needs an authenticated account with database management rights.
Sources
Last reviewed: 19 October 2026.
