CVE-2023-7248 is an input validation flaw in the authentication functions of OpenText Vertica Management Console, where crafted requests can bypass checks. It scores 5.0 (Medium) and the vector needs a local user to act. Upgrade to 11.1.1-25, 12.0.4-19, or a 23.x or 24.x release, depending on your line.
What's affected
The record quotes the vendor notice. Affected Management Console versions: 10.x, 11.1.1-24 or lower, and 12.0.4-18 or lower.
Fixed: 11.1.1-25, 12.0.4-19, 23.x and 24.x. Users on 10.x are told to move to the latest versions. I could not load the vendor knowledge base page, so these versions come from the NVD description, which reproduces the vendor text. Check the OpenText advisory (KM000027542) before you schedule the upgrade.
The weakness is CWE-20, improper input validation. The vector is local with user interaction and a changed scope, with low impact on integrity and availability. KEV is false and no source I read describes exploitation in the wild.
How to check if you're exposed
Open the Management Console and read its version, or ask your database team. If it is on 10.x, or at 11.1.1-24 or 12.0.4-18 or older, it is affected.
Also list who can reach the console. Management consoles often run on an administration network, and their reachability matters more than the score suggests.
What to do now
- Upgrade the Management Console to 11.1.1-25, 12.0.4-19, 23.x or 24.x. On 10.x, move to a current release.
- Restrict network access to the console to the administrators who need it.
- Review console login and session logs for requests you cannot explain.
- Check the OpenText advisory for any extra steps specific to your version.
Why it matters
The record describes crafted requests and sequences that circumvent an authentication function. That points to a validation gap: the console accepts a request shape it should have rejected. The class is improper input validation, which sits behind many authentication bugs.
The score is moderate because the vector is local and needs a user to act. That does not make it ignorable. A management console controls database administration, and administrative tools deserve patches even when the score looks low.
A practical way to prioritize is to ask what the console can reach. If it can create users, change settings or start jobs on the database cluster, an attacker who gets past its login gains those powers, regardless of how the score was calculated. Pair the upgrade with a review of who has console accounts, and remove the ones that are no longer needed.
If you cannot upgrade this week, narrow access first. Allow the console only from an administration network or a bastion host, and log every login so that unexpected sessions stand out.
Quick check
Which version should I move to?
Per the vendor text in the record: 11.1.1-25 on the 11.1.1 line, 12.0.4-19 on the 12.0.4 line, or 23.x or 24.x. For 10.x, upgrade to the latest.
Is the Vertica database itself affected?
The record names the Management Console only.
Sources
Last reviewed: 19 October 2026.
