6.3
Medium
CVE-2026-76580 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText…
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Cross-Site Scripting (XSS). This issue affects OpenText Directory Services (OTDS): from 25.1 through 26.2.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:NExploitable remotely over the network, without an account and if a user takes an action; with no direct impact on the vulnerable system.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- Active
- Confidentiality
- None
- Integrity
- None
- Availability
- None
- Confidentiality of other systems
- High
- Integrity of other systems
- High
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenText Directory Services (OTDS) 26.2 | earliest → < 26.2.5 | 26.2.5 |
| OpenText Directory Services (OTDS) 26.1 | earliest → < 26.1.8 | 26.1.8 |
| OpenText Directory Services (OTDS) 25.4 | earliest → < 25.4.11 | 25.4.11 |
| OpenText Directory Services (OTDS) 25.3 | earliest → < 25.3.13 | 25.3.13 |
| OpenText Directory Services (OTDS) 25.1 | 25.1 → 26.2 | No fix stated |