CVE-2023-7249 is a path traversal flaw in OpenText Directory Services affecting versions from 16.4.2 up to but not including 24.1. It scores 9.8 (Critical) and needs no login. Upgrade to 24.1 or later, and check the OpenText knowledge base article for steps.
What's affected
Affected: OpenText Directory Services from 16.4.2 before 24.1, per the record. Fixed: 24.1, which is the first version outside the affected range. I could not load the vendor article (KB0807814), so confirm the details and any extra steps there.
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The vector is network reachable, no privileges, no user interaction, and high impact on confidentiality, integrity and availability. KEV is false, and I found no source describing exploitation in the wild.
How to check if you're exposed
Find your Directory Services version in the product's administration console or from your deployment records. Anything from 16.4.2 up to, but not including, 24.1 is in range.
Check whether the service is reachable from outside your network. A directory service has no business being on the internet, and path traversal bugs are easy to probe from anywhere the service answers.
What to do now
- Upgrade OpenText Directory Services to 24.1 or later.
- Restrict network access to the service to the systems that need it, and block it at the perimeter.
- Review web and service logs for requests with unusual path sequences.
- Rotate credentials and keys stored on the host if you cannot rule out file access.
Why it matters
Path traversal lets a request step out of the folder the application meant to serve and reach other files on the system. If the service can also write, an attacker may change files, not only read them, which is why the impact is rated high across all three areas.
The fix is for the application to resolve and check paths against an allowed root. Defenders can cut the damage by running services with minimal file rights.
Directory services also tend to hold sensitive material: identity data, configuration and sometimes keys. Even if you believe the service is not exposed, internal reachability matters. An attacker who lands on any machine in the same network can often reach it. Segmenting the service so that only the applications that depend on it can connect is a cheap control that works whether or not the patch has landed.
When you upgrade, test the new version in a staging copy first if you can, because identity services are hard to roll back. Keep a backup of the configuration, and check the vendor notes for any steps that apply to your starting version.
Quick check
What fixes CVE-2023-7249?
Version 24.1 or later of OpenText Directory Services, per the record's affected range.
Does it need authentication?
The vector shows no privileges required.
Sources
Last reviewed: 19 October 2026.
