CVE-2025-12455

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12455", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2025-10-28T21:28:44.651Z", "datePublished": "2026-03-13T18:30:27.903Z", "dateUpdated": "2026-03-13T19:33:40.096Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2026-03-13T18:30:27.903Z"}, "title": "Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText\u2122 Vertica.", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-204", "description": "CWE-204 Observable response discrepancy", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-49", "descriptions": [{"lang": "en", "value": "CAPEC-49 Password Brute Forcing"}]}], "affected": [{"vendor": "OpenText\u2122", "product": "Vertica", "versions": [{"status": "affected", "version": "10.0", "lessThanOrEqual": "10.x", "versionType": "custom"}, {"status": "affected", "version": "11.0", "lessThanOrEqual": "11.x", "versionType": "custom"}, {"status": "affected", "version": "12.0", "lessThanOrEqual": "12.x", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Observable response discrepancy vulnerability in OpenText\u2122 Vertica allows Password Brute Forcing.\u00a0\u00a0\nThe vulnerability could lead to Password Brute Forcing in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Observable response discrepancy vulnerability in OpenText\u2122 Vertica allows Password Brute Forcing.&nbsp;&nbsp;\nThe vulnerability could lead to Password Brute Forcing in Vertica management console application.<p>This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X.</p>"}]}], "references": [{"url": "https://portal.microfocus.com/s/article/KM000045854?language=en_US"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "Automatable": "YES", "Recovery": "USER", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/R:U"}}], "solutions": [{"lang": "en", "value": "https://portal.microfocus.com/s/article/KM000045854?language=en_US", "supportingMedia": [{"type": "text/html", "base64": false, "value": "https://portal.microfocus.com/s/article/KM000045854?language=en_US"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:33:33.057816Z", "id": "CVE-2025-12455", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:33:40.096Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12455", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T19:33:33.057816Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:33:37.168Z"}}], "cna": {"title": "Username Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText\u2122 Vertica.", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-49", "descriptions": [{"lang": "en", "value": "CAPEC-49 Password Brute Forcing"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 5.1, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/R:U", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenText\u2122", "product": "Vertica", "versions": [{"status": "affected", "version": "10.0", "versionType": "custom", "lessThanOrEqual": "10.x"}, {"status": "affected", "version": "11.0", "versionType": "custom", "lessThanOrEqual": "11.x"}, {"status": "affected", "version": "12.0", "versionType": "custom", "lessThanOrEqual": "12.x"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "https://portal.microfocus.com/s/article/KM000045854?language=en_US", "supportingMedia": [{"type": "text/html", "value": "https://portal.microfocus.com/s/article/KM000045854?language=en_US", "base64": false}]}], "references": [{"url": "https://portal.microfocus.com/s/article/KM000045854?language=en_US"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Observable response discrepancy vulnerability in OpenText\u2122 Vertica allows Password Brute Forcing.\u00a0\u00a0\nThe vulnerability could lead to Password Brute Forcing in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X.", "supportingMedia": [{"type": "text/html", "value": "Observable response discrepancy vulnerability in OpenText\u2122 Vertica allows Password Brute Forcing.&nbsp;&nbsp;\nThe vulnerability could lead to Password Brute Forcing in Vertica management console application.<p>This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204 Observable response discrepancy"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2026-03-13T18:30:27.903Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12455", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:33:40.096Z", "dateReserved": "2025-10-28T21:28:44.651Z", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "datePublished": "2026-03-13T18:30:27.903Z", "assignerShortName": "OpenText"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Vertica", "vendor": "OpenText\u2122", "versions": [{"lessThanOrEqual": "10.x", "status": "affected", "version": "10.0", "versionType": "custom"}, {"lessThanOrEqual": "11.x", "status": "affected", "version": "11.0", "versionType": "custom"}, {"lessThanOrEqual": "12.x", "status": "affected", "version": "12.0", "versionType": "custom"}]}], "source": "security@opentext.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opentext:vertica:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE167C3A-8090-4A7C-A725-3406D3CF1418", "versionEndIncluding": "12.0.4-34", "versionStartIncluding": "10.0.0-0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Observable response discrepancy vulnerability in OpenText\u2122 Vertica allows Password Brute Forcing.\u00a0\u00a0\nThe vulnerability could lead to Password Brute Forcing in Vertica management console application.This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X."}, {"lang": "es", "value": "Vulnerabilidad de discrepancia de respuesta observable en OpenText\u2122 Vertica permite el forzado de contrase\u00f1a por fuerza bruta.\nLa vulnerabilidad podr\u00eda conducir al forzado de contrase\u00f1a por fuerza bruta en la aplicaci\u00f3n de consola de gesti\u00f3n de Vertica. Este problema afecta a Vertica: desde 10.0 hasta 10.X, desde 11.0 hasta 11.X, desde 12.0 hasta 12.X."}], "id": "CVE-2025-12455", "lastModified": "2026-06-17T08:32:25.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@opentext.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12455", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:33:33.057816Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:53:47.873", "references": [{"source": "security@opentext.com", "tags": ["Vendor Advisory"], "url": "https://portal.microfocus.com/s/article/KM000045854?language=en_US"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "security@opentext.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.0,10.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.0,11.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[12.0,12.x]"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Vertica", "source": "cna", "vendor": "OpenText\u2122"}, "product": "vertica", "vendor": "opentext"}], "analysis": {"en": {"generated_at": "2026-03-19T14:37:27.427963+00:00", "value": {"mitigation_remediation": ["Apply the official Vertica security patch as provided by OpenText (https://portal.microfocus.com/s/article/KM000045854?language=en_US).", "Verify that the Vertica management console no longer exhibits differing responses for failed login attempts after patch deployment.", "If immediate patching is not feasible, enforce account lockout or rate\u2011limit policies on the management console to mitigate brute\u2011force attempts as a temporary countermeasure."], "summary": {"action": "Patch Now", "impact": "Password Brute Forcing"}, "threat_synthesis": {"affected_systems": "OpenText Vertica versions from 10.0 through 10.X, 11.0 through 11.X, and 12.0 through 12.X are affected. No sub\u2011version details are provided, so all releases within these version ranges should be considered vulnerable until a patch is applied.", "description_and_impact": "The vulnerability is an observable response discrepancy that enables password brute forcing against the Vertica management console. An attacker can submit multiple credential attempts and infer success or failure by the differing responses, potentially gaining unauthorized access. This weakness is categorized as CWE-204, reflecting an observable logic flaw that undermines authentication integrity.", "risk_and_exploitability": "The CVSS score of 5.1 indicates a medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by targeting the management console login interface and brute\u2011forcing credentials based on response time or content differences. Because the flaw resides in authentication, the risk impacts confidentiality and availability of the management console but does not grant arbitrary code execution."}}}}, "created": "2026-03-16T09:24:42.655544+00:00", "updated": "2026-03-23T13:40:33.706855+00:00", "vendors": ["opentext", "opentext$PRODUCT$vertica"]}