CVE-2004-2496

Vulnerability

The HTTP daemon in OpenText FirstClass versions 7.1 and 8.0 is vulnerable to a denial-of-service condition. Sending a large number of POST requests to the /Search endpoint exhausts resources, leading to service availability loss. [1]

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a high volume of POST requests to http://target/Search. No prior authentication or special privileges are required; the attacker only needs network connectivity to the target system. [1]

Impact

Successful exploitation causes the HTTP daemon to become unresponsive, rendering the FirstClass service unavailable for legitimate users. The impact is limited to denial of service; no data disclosure, modification, or code execution has been reported. [1]

Mitigation

The vendor advisory does not confirm whether a fix was released; no specific patched version or workaround is documented in the available references. Users should consult OpenText for updated versions or implement network-level throttling of POST requests to /Search as a temporary measure. [1]