Is OpenText Content Server safe?

Question

Accepted Answer

OpenText Content Server is medium risk. Dynamic analysis confirmed that any website can dispatch a CustomEvent named 'OpenText_WebExtV3_ContentJS_Event' and the extension's content script relays the payload to the OpenText Desktop native application without verifying which website sent the request. We dispatched this event from example.com — a non-OpenText origin — and observed the extension respond within approximately one second with the native application's version number, confirming the bridge is accessible from arbitrary web origins.

Is Content Server Browser Web Extension safe?

Findings