Vulnerabilites related to microfocus - enterprise_server
CVE-2017-7424 (GCVE-0-2017-7424)
Vulnerability from cvelistv5
Published
2017-08-21 15:00
Modified
2024-09-16 20:36
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Path Traversal () and Information Disclosure (CWE-200)
Summary
A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is configured. Note esfadmingui is not enabled by default.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Micro Focus | Micro Focus Enterprise Developer, Micro Focus Enterprise Server |
Version: All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.286Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
],
"datePublic": "2017-08-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is configured. Note esfadmingui is not enabled by default."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal (CWE-22) and Information Disclosure (CWE-200)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:44",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2017-08-19T00:00:00",
"ID": "CVE-2017-7424",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"version": {
"version_data": [
{
"version_value": "All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is configured. Note esfadmingui is not enabled by default."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Path Traversal (CWE-22) and Information Disclosure (CWE-200)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017",
"refsource": "MISC",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2017-7424",
"datePublished": "2017-08-21T15:00:00Z",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-09-16T20:36:27.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-9524 (GCVE-0-2020-9524)
Vulnerability from cvelistv5
Published
2020-05-18 13:19
Modified
2024-08-04 10:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Cross Site scripting.
Summary
Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS).
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Enterprise Server and Enterprise developer. |
Version: All versions prior to version 5.0 Patch Update 8. |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:34:38.169Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03640252"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Enterprise Server and Enterprise developer.",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All versions prior to version 5.0 Patch Update 8."
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross Site scripting.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:28",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03640252"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"ID": "CVE-2020-9524",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Enterprise Server and Enterprise developer.",
"version": {
"version_data": [
{
"version_value": "All versions prior to version 5.0 Patch Update 8."
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross Site scripting."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03640252",
"refsource": "MISC",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03640252"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2020-9524",
"datePublished": "2020-05-18T13:19:53",
"dateReserved": "2020-03-01T00:00:00",
"dateUpdated": "2024-08-04T10:34:38.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7420 (GCVE-0-2017-7420)
Vulnerability from cvelistv5
Published
2017-08-21 15:00
Modified
2024-09-16 20:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Authentication Bypass ()
Summary
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275).
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Micro Focus | Micro Focus Enterprise Developer, Micro Focus Enterprise Server |
Version: All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.250Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
],
"datePublic": "2017-08-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Authentication Bypass (CWE-287)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:59",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2017-08-19T00:00:00",
"ID": "CVE-2017-7420",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"version": {
"version_data": [
{
"version_value": "All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Authentication Bypass (CWE-287)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017",
"refsource": "MISC",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2017-7420",
"datePublished": "2017-08-21T15:00:00Z",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-09-16T20:21:20.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32265 (GCVE-0-2023-32265)
Vulnerability from cvelistv5
Published
2023-07-20 13:01
Modified
2024-10-21 13:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server.
An attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting users’ permissions in the Micro Focus Directory Server also reduce the exposure to this issue.
Given the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Micro Focus | Enterprise Server |
Version: 6.0 ≤ 6.0 update 24 Version: 7.0 ≤ 7.0 update 17 Version: 8.0 ≤ 8.0 update 6 |
|||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:10:24.245Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://portal.microfocus.com/s/article/KM000019323?language=en_US"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32265",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T13:04:02.427181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T13:05:58.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Enterprise Server",
"vendor": "Micro Focus",
"versions": [
{
"lessThanOrEqual": "6.0 update 24",
"status": "affected",
"version": "6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0 update 17",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0 update 6",
"status": "affected",
"version": "8.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Test Server",
"vendor": "Micro Focus",
"versions": [
{
"lessThanOrEqual": "6.0 update 24",
"status": "affected",
"version": "6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0 update 17",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0 update 6",
"status": "affected",
"version": "8.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Enterprise Developer",
"vendor": "Micro Focus",
"versions": [
{
"lessThanOrEqual": "6.0 update 24",
"status": "affected",
"version": "6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0 update 17",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0 update 6",
"status": "affected",
"version": "8.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Visual COBOL",
"vendor": "Micro Focus",
"versions": [
{
"lessThanOrEqual": "6.0 update 24",
"status": "affected",
"version": "6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0 update 17",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0 update 6",
"status": "affected",
"version": "8.0 ",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "COBOL Server",
"vendor": "Micro Focus",
"versions": [
{
"lessThanOrEqual": "6.0 update 24",
"status": "affected",
"version": "6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0 update 17",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0 update 6",
"status": "affected",
"version": "8.0 ",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Richard R Rohrkemper III @Early Warning Security "
}
],
"datePublic": "2023-07-19T13:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server.\u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting users\u00e2\u20ac\u2122 permissions in the Micro Focus Directory Server also reduce the exposure to this issue.\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eGiven the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.\u003c/span\u003e\n\n"
}
],
"value": "\nA potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server.\nAn attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting users\u00e2\u20ac\u2122 permissions in the Micro Focus Directory Server also reduce the exposure to this issue.\n\nGiven the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.\n\n"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Password exposure for service account"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-20T13:01:38.269Z",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "OpenText"
},
"references": [
{
"url": "https://portal.microfocus.com/s/article/KM000019323?language=en_US"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eEnterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server Versions 6.0, 7.0, and 8.0 all include a fix for this issue in their latest released patch updates.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nEnterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server Versions 6.0, 7.0, and 8.0 all include a fix for this issue in their latest released patch updates.\n\n\n"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Mitigations and availability of updates relating to security vulnerability in ESCWA component CVE-2023-32265.",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "OpenText",
"cveId": "CVE-2023-32265",
"datePublished": "2023-07-20T13:01:38.269Z",
"dateReserved": "2023-05-05T14:42:20.153Z",
"dateUpdated": "2024-10-21T13:05:58.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7421 (GCVE-0-2017-7421)
Vulnerability from cvelistv5
Published
2017-08-21 15:00
Modified
2024-09-16 22:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-Site Scripting ()
Summary
Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Micro Focus | Micro Focus Enterprise Developer, Micro Focus Enterprise Server |
Version: All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.241Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
],
"datePublic": "2017-08-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-Site Scripting (CWE-79)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:42",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2017-08-19T00:00:00",
"ID": "CVE-2017-7421",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"version": {
"version_data": [
{
"version_value": "All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting (CWE-79)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017",
"refsource": "MISC",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2017-7421",
"datePublished": "2017-08-21T15:00:00Z",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-09-16T22:34:58.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-9523 (GCVE-0-2020-9523)
Vulnerability from cvelistv5
Published
2020-04-17 14:18
Modified
2024-08-04 10:34
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Insufficiently protected credentials
Summary
Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account's security.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Enterprise developer and server. |
Version: All version prior to version 4.0 Patch Update 16, and version 5.0 Patch Update 6. |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:34:38.203Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03634936"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Enterprise developer and server.",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All version prior to version 4.0 Patch Update 16, and version 5.0 Patch Update 6."
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account\u0027s security."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Insufficiently protected credentials",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:26",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03634936"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"ID": "CVE-2020-9523",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Enterprise developer and server.",
"version": {
"version_data": [
{
"version_value": "All version prior to version 4.0 Patch Update 16, and version 5.0 Patch Update 6."
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account\u0027s security."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Insufficiently protected credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03634936",
"refsource": "MISC",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03634936"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2020-9523",
"datePublished": "2020-04-17T14:18:04",
"dateReserved": "2020-03-01T00:00:00",
"dateUpdated": "2024-08-04T10:34:38.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5187 (GCVE-0-2017-5187)
Vulnerability from cvelistv5
Published
2017-08-21 15:00
Modified
2024-09-16 22:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery () and Remote Code Execution (CWE-78)
Summary
A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Micro Focus | Micro Focus Enterprise Developer, Micro Focus Enterprise Server |
Version: 2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T14:55:35.343Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
],
"datePublic": "2017-08-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CWE-352) and Remote Code Execution (CWE-78)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:51",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2017-08-19T00:00:00",
"ID": "CVE-2017-5187",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"version": {
"version_data": [
{
"version_value": "2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Request Forgery (CWE-352) and Remote Code Execution (CWE-78)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017",
"refsource": "MISC",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2017-5187",
"datePublished": "2017-08-21T15:00:00Z",
"dateReserved": "2017-01-06T00:00:00",
"dateUpdated": "2024-09-16T22:41:17.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-4501 (GCVE-0-2023-4501)
Vulnerability from cvelistv5
Published
2023-09-12 18:05
Modified
2024-09-26 14:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.
Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.
Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OpenText | Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server |
Version: 7.0.19 Version: 8.0.8 Version: 9.0.1 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:31:06.347Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://portal.microfocus.com/s/article/KM000021287"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:opentext:visual_cobal_cobal_server_enterprise_developer_enterprise_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "visual_cobal_cobal_server_enterprise_developer_enterprise_server",
"vendor": "opentext",
"versions": [
{
"lessThan": "7.0.21",
"status": "affected",
"version": "7.0.19",
"versionType": "custom"
},
{
"lessThan": "8.0.10",
"status": "affected",
"version": "8.0.8",
"versionType": "custom"
},
{
"lessThan": "9.0.2",
"status": "affected",
"version": "9.0.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-4501",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T13:56:28.372526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T14:08:41.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"Linux",
"AIX Solaris HP-UX"
],
"product": "Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server",
"vendor": "OpenText",
"versions": [
{
"lessThan": "7.0.21",
"status": "affected",
"version": "7.0.19",
"versionType": "patch update"
},
{
"lessThan": "8.0.10",
"status": "affected",
"version": "8.0.8",
"versionType": "patch update"
},
{
"lessThan": "9.0.2",
"status": "affected",
"version": "9.0.1",
"versionType": "patch update"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Contact OpenText Support for more information.\u003cbr\u003e"
}
],
"value": "Contact OpenText Support for more information.\n"
}
],
"datePublic": "2023-09-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.\u003cbr\u003e\u003cbr\u003eMitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.\u003cbr\u003e\u003cbr\u003eAdministrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.\u003cbr\u003e"
}
],
"value": "User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.\n\nMitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.\n\nAdministrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.\n"
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OpenText has not been informed of any exploitation of this vulnerability.\u003cbr\u003e"
}
],
"value": "OpenText has not been informed of any exploitation of this vulnerability.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-358",
"description": "CWE-358 Improperly Implemented Security Check for Standard",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-253",
"description": "CWE-253 Incorrect Check of Function Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-12T18:05:56.684Z",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "OpenText"
},
"references": [
{
"url": "https://portal.microfocus.com/s/article/KM000021287"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install 7.0 Patch Update 21, 8.0 Patch Update 10, or 9.0 Patch Update 2, or later, when available. Hotfix overlays are available now for common platforms and can be produced for other platforms; contact OpenText Support to request a hotfix overlay.\u003cbr\u003e"
}
],
"value": "Install 7.0 Patch Update 21, 8.0 Patch Update 10, or 9.0 Patch Update 2, or later, when available. Hotfix overlays are available now for common platforms and can be produced for other platforms; contact OpenText Support to request a hotfix overlay.\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2023-08-08T00:00:00.000Z",
"value": "Reported by customer."
},
{
"lang": "en",
"time": "2023-08-22T00:00:00.000Z",
"value": "Fix made available."
},
{
"lang": "en",
"time": "2023-09-01T00:00:00.000Z",
"value": "Security bulletin published."
}
],
"title": "Authentication bypass in OpenText (Micro Focus) Enterprise Server",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Contact OpenText Support for workaround details.\u003cbr\u003e"
}
],
"value": "Contact OpenText Support for workaround details.\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "OpenText",
"cveId": "CVE-2023-4501",
"datePublished": "2023-09-12T18:05:56.684Z",
"dateReserved": "2023-08-23T18:01:40.973Z",
"dateUpdated": "2024-09-26T14:08:41.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11651 (GCVE-0-2019-11651)
Vulnerability from cvelistv5
Published
2019-10-02 20:11
Modified
2024-08-04 23:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Reflected XSS
Summary
Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Micro Focus Enterprise Developer and Enterprise Server |
Version: All versions prior to version 3.0 Patch Update 20. version 4.0 Patch Update 12 and version 5.0 Patch Update 2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:03:31.140Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03532232"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Enterprise Developer and Enterprise Server",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All versions prior to version 3.0 Patch Update 20. version 4.0 Patch Update 12 and version 5.0 Patch Update 2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Reflected XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:44",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03532232"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"ID": "CVE-2019-11651",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Micro Focus Enterprise Developer and Enterprise Server",
"version": {
"version_data": [
{
"version_value": "All versions prior to version 3.0 Patch Update 20. version 4.0 Patch Update 12 and version 5.0 Patch Update 2"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Reflected XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03532232",
"refsource": "MISC",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03532232"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2019-11651",
"datePublished": "2019-10-02T20:11:26",
"dateReserved": "2019-05-01T00:00:00",
"dateUpdated": "2024-08-04T23:03:31.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7423 (GCVE-0-2017-7423)
Vulnerability from cvelistv5
Published
2017-08-21 15:00
Modified
2024-09-16 17:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery ()
Summary
A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Micro Focus | Micro Focus Enterprise Developer, Micro Focus Enterprise Server |
Version: 2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
],
"datePublic": "2017-08-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CWE-352)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:16:05",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2017-08-19T00:00:00",
"ID": "CVE-2017-7423",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"version": {
"version_data": [
{
"version_value": "2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Request Forgery (CWE-352)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017",
"refsource": "MISC",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2017-7423",
"datePublished": "2017-08-21T15:00:00Z",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-09-16T17:23:07.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-12469 (GCVE-0-2018-12469)
Vulnerability from cvelistv5
Published
2018-10-12 13:00
Modified
2024-09-16 19:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-476 - NULL Pointer Dereference ()
Summary
Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Micro Focus | Micro Focus Enterprise Developer, Micro Focus Enterprise Server |
Version: All versions before 3.0 Patch Update 12, 4.0 Patch Update 2, 5.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T08:38:05.945Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "All versions before 3.0 Patch Update 12, 4.0 Patch Update 2, 5.0"
}
]
}
],
"datePublic": "2018-10-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference (CWE-476)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:44",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2018-10-04T00:00:00",
"ID": "CVE-2018-12469",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"version": {
"version_data": [
{
"version_value": "All versions before 3.0 Patch Update 12, 4.0 Patch Update 2, 5.0"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "NULL Pointer Dereference (CWE-476)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018",
"refsource": "CONFIRM",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2018-12469",
"datePublished": "2018-10-12T13:00:00Z",
"dateReserved": "2018-06-15T00:00:00",
"dateUpdated": "2024-09-16T19:46:30.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7422 (GCVE-0-2017-7422)
Vulnerability from cvelistv5
Published
2017-08-21 15:00
Modified
2024-09-17 00:32
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross-Site Scripting ()
Summary
Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features, if this component is configured. Note esfadmingui is not enabled by default.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Micro Focus | Micro Focus Enterprise Developer, Micro Focus Enterprise Server |
Version: 2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:04:11.693Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
],
"datePublic": "2017-08-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features, if this component is configured. Note esfadmingui is not enabled by default."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross-Site Scripting (CWE-79)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:47",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2017-08-19T00:00:00",
"ID": "CVE-2017-7422",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
"version": {
"version_data": [
{
"version_value": "2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features, if this component is configured. Note esfadmingui is not enabled by default."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting (CWE-79)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017",
"refsource": "MISC",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2017-7422",
"datePublished": "2017-08-21T15:00:00Z",
"dateReserved": "2017-04-05T00:00:00",
"dateUpdated": "2024-09-17T00:32:17.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2017-08-21 15:29
Modified
2025-04-20 01:37
Severity ?
Summary
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_server | * | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server_monitor_and_control | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E13FE8F0-D7FF-4C77-A0D9-DBE13222B2E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "ADAA9BF3-9B1F-44AE-9D74-B8747979DBA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "4B18C3E3-494E-40A7-92F7-E7B95E9C094F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6A661E8-AFD3-4B51-9E69-AD709A969ECC",
"versionEndIncluding": "2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "E23C5342-8F45-4675-9401-EBC7287D65CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "6AD523A5-68BB-4397-945E-C95FD0E3229A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server_monitor_and_control:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C94B4907-6212-448D-A8F0-E5A8FD701F58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275)."
},
{
"lang": "es",
"value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n (CWE-287) en ESMAC (tambi\u00e9n llamado Enterprise Server Monitor and Control) en Micro Focus Enterprise Developer y Enterprise Server 2.3 y anteriores, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permite que atacantes remotos sin autenticar vean y alteren la informaci\u00f3n de configuraci\u00f3n y alteren el estado del producto en ejecuci\u00f3n (CWE-275)."
}
],
"id": "CVE-2017-7420",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-08-21T15:29:00.217",
"references": [
{
"source": "security@opentext.com",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-08-21 15:29
Modified
2025-04-20 01:37
Severity ?
Summary
Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features, if this component is configured. Note esfadmingui is not enabled by default.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E13FE8F0-D7FF-4C77-A0D9-DBE13222B2E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "ADAA9BF3-9B1F-44AE-9D74-B8747979DBA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "4B18C3E3-494E-40A7-92F7-E7B95E9C094F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1E2A416-8236-43F3-8305-365F0871273D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "E23C5342-8F45-4675-9401-EBC7287D65CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "6AD523A5-68BB-4397-945E-C95FD0E3229A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features, if this component is configured. Note esfadmingui is not enabled by default."
},
{
"lang": "es",
"value": "Las vulnerabilidades de cross-Site Scripting (XSS) reflejado y stored en esfadmingui en Micro Focus Enterprise Developer y Enterprise Server 2.3, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permiten que atacantes remotos autenticados omitan los mecanismos de protecci\u00f3n (CWE-693) y otras caracter\u00edsticas de seguridad si este componente est\u00e1 configurado. N\u00f3tese que esfadmingui no est\u00e1 habilitado por defecto."
}
],
"id": "CVE-2017-7422",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-08-21T15:29:00.293",
"references": [
{
"source": "security@opentext.com",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-04-17 15:15
Modified
2024-11-21 05:40
Severity ?
Summary
Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account's security.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E0E5CE0D-8971-4D61-A021-395A45B2F0E4",
"versionEndIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "53034D98-15C1-4628-90E8-80A8BA25C800",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_1:*:*:*:*:*:*",
"matchCriteriaId": "C31EF8D8-20FA-4E8D-9C67-AB75680158CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_10:*:*:*:*:*:*",
"matchCriteriaId": "6CED357F-3AB5-4DF7-A188-37F7109B7FBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_11:*:*:*:*:*:*",
"matchCriteriaId": "1943146C-8F5D-4F63-A214-D05CE108FECC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_12:*:*:*:*:*:*",
"matchCriteriaId": "DFAB29B5-3E61-4EA5-AE37-5C51BC3052AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_13:*:*:*:*:*:*",
"matchCriteriaId": "E0AAB00E-42B5-442E-8C33-713C998BC9AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_14:*:*:*:*:*:*",
"matchCriteriaId": "1A4D7425-9F68-4CB8-959D-2B2C8927E595",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_15:*:*:*:*:*:*",
"matchCriteriaId": "1FC1F4F3-3B11-44AA-ABA9-EAC09E67F0AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_2:*:*:*:*:*:*",
"matchCriteriaId": "0C593ACC-80F0-4027-954C-0887549D019D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_3:*:*:*:*:*:*",
"matchCriteriaId": "C4C180E6-A07A-4368-BA88-2686C4AB510A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_4:*:*:*:*:*:*",
"matchCriteriaId": "687C1DA0-B34A-4975-8C85-00EAF03E3B95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_5:*:*:*:*:*:*",
"matchCriteriaId": "C6E07732-FEFE-4E86-AD5A-348316BAA76E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_6:*:*:*:*:*:*",
"matchCriteriaId": "86BD60D7-34CF-429C-9F46-7039D2A3AD3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_7:*:*:*:*:*:*",
"matchCriteriaId": "386BFB68-2C89-4093-8A7E-D9A838DA716E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_8:*:*:*:*:*:*",
"matchCriteriaId": "A0AF5FFC-A062-42ED-B87F-5AA6915FBA03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update_9:*:*:*:*:*:*",
"matchCriteriaId": "C3942E78-61A2-4F70-B32B-C2BE31D9055E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "3C73BDBE-2719-4020-B953-1580BB78CB0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:update_1:*:*:*:*:*:*",
"matchCriteriaId": "F043FB8B-665F-409C-9F81-1CCE6501DBC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:update_2:*:*:*:*:*:*",
"matchCriteriaId": "C49FA390-A44E-4285-AC90-9D032122CA45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:update_3:*:*:*:*:*:*",
"matchCriteriaId": "50D1B082-D46F-43F7-A6A4-060517F7433E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:update_4:*:*:*:*:*:*",
"matchCriteriaId": "437BD37E-3C37-4CB3-8B73-0CC48DD4E4BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:update_5:*:*:*:*:*:*",
"matchCriteriaId": "7B82C43A-9BA9-40A9-8A47-3830733F859B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "03D9F8A5-244D-4E7E-8F3D-C231A31524EC",
"versionEndIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "E8F59F96-F1CD-4750-94AE-FF80EAA5C461",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_1:*:*:*:*:*:*",
"matchCriteriaId": "2C759BA5-B3DA-4C00-83AF-2E9838406832",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_10:*:*:*:*:*:*",
"matchCriteriaId": "4B293F46-D8FC-45C5-BA6F-0F0CDA9E477B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_11:*:*:*:*:*:*",
"matchCriteriaId": "DF915FCA-6C3C-420C-9DBD-71E228B104ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_12:*:*:*:*:*:*",
"matchCriteriaId": "47EE9813-D518-4DDE-9891-39EF5DCF0D15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_13:*:*:*:*:*:*",
"matchCriteriaId": "700A39E4-F051-4CD4-A886-AB09439A1D94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_14:*:*:*:*:*:*",
"matchCriteriaId": "F52B5A62-B389-43E3-A379-3F1EFC3CE8AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_15:*:*:*:*:*:*",
"matchCriteriaId": "63E64A7C-97CF-49CA-A6FB-3F8A9C456B6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_2:*:*:*:*:*:*",
"matchCriteriaId": "BD78A09A-3CAF-4D5E-9F48-E7C5F3EA2F19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_3:*:*:*:*:*:*",
"matchCriteriaId": "0510269B-B6EF-418A-9D6A-5F18202177C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_4:*:*:*:*:*:*",
"matchCriteriaId": "312625BF-6401-415B-A46B-36DF592749C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_5:*:*:*:*:*:*",
"matchCriteriaId": "28628C62-DFE7-4719-82DB-492BF896556A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_6:*:*:*:*:*:*",
"matchCriteriaId": "F83018A3-B5CA-4230-9AB2-EE5B86C54D0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_7:*:*:*:*:*:*",
"matchCriteriaId": "6402FBE2-4609-4904-95F5-90B76BEA9F94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_8:*:*:*:*:*:*",
"matchCriteriaId": "F0086334-B0FE-484B-AC62-E89443717504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update_9:*:*:*:*:*:*",
"matchCriteriaId": "8986C163-FAED-4EED-B6CD-778FE7C35F95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "600A95A6-A1F6-45F1-8856-FB1968E084ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:update_1:*:*:*:*:*:*",
"matchCriteriaId": "C465513C-3EBF-4B1B-A6D6-CA4308155D55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:update_2:*:*:*:*:*:*",
"matchCriteriaId": "3176F896-BFCC-4E7A-AFAC-65A6F5BED2CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:update_3:*:*:*:*:*:*",
"matchCriteriaId": "26509099-64D1-4776-8EB8-4C7EC30858AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:update_4:*:*:*:*:*:*",
"matchCriteriaId": "9102EDA5-05B1-4D8A-91FE-AEB18D1A568C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:update_5:*:*:*:*:*:*",
"matchCriteriaId": "F82BD2CA-1068-41C5-B02D-C44B3F756D00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account\u0027s security."
},
{
"lang": "es",
"value": "Una vulnerabilidad de credenciales insuficientemente protegidas en el desarrollador empresarial y el servidor empresarial de Micro Focus, afectando a todas las versiones anteriores a 4.0 Patch Update 16, y versi\u00f3n 5.0 Patch Update 6. La vulnerabilidad podr\u00eda permitir a un atacante transmitir credenciales del hash para la cuenta de usuario que ejecuta el Micro Focus Directory Server (MFDS) en un sitio arbitrario, comprometiendo la seguridad de esa cuenta."
}
],
"id": "CVE-2020-9523",
"lastModified": "2024-11-21T05:40:48.023",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-04-17T15:15:12.930",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03634936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03634936"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-522"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-10-02 21:15
Modified
2024-11-21 04:21
Severity ?
Summary
Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:-:*:*:*:*:*:*",
"matchCriteriaId": "E520C725-28E7-447E-8D13-0FCA3E1102DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_1:*:*:*:*:*:*",
"matchCriteriaId": "D9737A07-8C0C-4498-B00D-C917D736CFA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_10:*:*:*:*:*:*",
"matchCriteriaId": "A23DC4FD-C8D2-4FED-B7F2-4FB07E650D1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_11:*:*:*:*:*:*",
"matchCriteriaId": "BE28ED29-373B-4815-9EB9-E70D4A9C893C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_12:*:*:*:*:*:*",
"matchCriteriaId": "A0EA0405-8885-4C91-B804-1785627DDF61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_13:*:*:*:*:*:*",
"matchCriteriaId": "5ECD6117-C0B2-42C5-BB29-DB1BE50EF266",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_14:*:*:*:*:*:*",
"matchCriteriaId": "434720E2-A9BA-4DA6-9316-0C1737699461",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_15:*:*:*:*:*:*",
"matchCriteriaId": "274B0CF9-93C6-473A-895F-5DEB47E7A635",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_16:*:*:*:*:*:*",
"matchCriteriaId": "0DE0381D-F512-4194-9D34-076E87152AD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_17:*:*:*:*:*:*",
"matchCriteriaId": "46806C31-4ED2-4C09-AB48-95DFD90A63B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_18:*:*:*:*:*:*",
"matchCriteriaId": "27026971-EDBB-4EE4-8D63-91889BEE2A31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_19:*:*:*:*:*:*",
"matchCriteriaId": "88A36343-FD91-4B64-BA8F-A7A8601C2578",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_2:*:*:*:*:*:*",
"matchCriteriaId": "A4E526D3-3B1C-4313-A6AE-68BF877BB1C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_3:*:*:*:*:*:*",
"matchCriteriaId": "80C4E997-985E-418D-B332-128620D6399D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_4:*:*:*:*:*:*",
"matchCriteriaId": "16DB159A-B3BF-4F22-A7E5-798B2BE935BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_5:*:*:*:*:*:*",
"matchCriteriaId": "95EDC120-8237-4C15-AACD-82970717B7F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_6:*:*:*:*:*:*",
"matchCriteriaId": "D9D20037-A0AD-4122-AF97-474052DCA65F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_7:*:*:*:*:*:*",
"matchCriteriaId": "BF3D08EE-845B-4952-8F61-41624A9A74B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_8:*:*:*:*:*:*",
"matchCriteriaId": "6256ED5F-2BDF-45A3-BF38-FC5B725FE293",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:patch_9:*:*:*:*:*:*",
"matchCriteriaId": "6E17A291-5BD3-4324-B0C2-4620AA1BE30A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "53034D98-15C1-4628-90E8-80A8BA25C800",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_1:*:*:*:*:*:*",
"matchCriteriaId": "B80E468E-8BB3-44A6-B781-57238B9FECE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_10:*:*:*:*:*:*",
"matchCriteriaId": "74B717E3-AAAF-4F99-8672-382EBFADCC87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_11:*:*:*:*:*:*",
"matchCriteriaId": "5F35F690-3FB2-45D6-9798-7CD66F7FE5C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_2:*:*:*:*:*:*",
"matchCriteriaId": "B9B1A025-7452-4C8E-A4D0-B0B2E991C2AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_3:*:*:*:*:*:*",
"matchCriteriaId": "4DEAA49C-ED22-4257-AF66-561BD42BEECF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_4:*:*:*:*:*:*",
"matchCriteriaId": "9A893B7D-C8BA-4CDD-BA75-7A095C1F6803",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_5:*:*:*:*:*:*",
"matchCriteriaId": "932C078A-13F9-45F1-81D1-A0EB0BF40310",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_6:*:*:*:*:*:*",
"matchCriteriaId": "25AB01B7-7264-4AEE-A4B6-895646C15FE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_7:*:*:*:*:*:*",
"matchCriteriaId": "50BC7F2E-1A89-4273-BAAD-3F56F998E444",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_8:*:*:*:*:*:*",
"matchCriteriaId": "06E684DE-4F56-4DB4-BBA6-8DCF7ECB8E74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:patch_9:*:*:*:*:*:*",
"matchCriteriaId": "5B703A7A-1400-4362-9710-7038022BA539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "3C73BDBE-2719-4020-B953-1580BB78CB0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:patch_1:*:*:*:*:*:*",
"matchCriteriaId": "B6AD863A-E5D2-4193-B72C-94B823EBA110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:-:*:*:*:*:*:*",
"matchCriteriaId": "667C08F5-8465-4458-94E9-E31324CBC712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_1:*:*:*:*:*:*",
"matchCriteriaId": "90E753B3-48E5-4B3D-B34D-4326E3125757",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_10:*:*:*:*:*:*",
"matchCriteriaId": "A75250AB-2777-4107-B967-CD469E2BF322",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_11:*:*:*:*:*:*",
"matchCriteriaId": "40ACBEFB-0D47-4650-9D4B-080DFA4C3E88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_12:*:*:*:*:*:*",
"matchCriteriaId": "B5D82D15-2486-4187-9B10-57FD503E70A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_13:*:*:*:*:*:*",
"matchCriteriaId": "A927325F-31C7-4298-B66B-555AA9F1C7EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_14:*:*:*:*:*:*",
"matchCriteriaId": "08026E77-2632-48E7-B9BF-4DDEFF6622E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_15:*:*:*:*:*:*",
"matchCriteriaId": "ABD5A657-2A33-414F-AE89-152246789302",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_16:*:*:*:*:*:*",
"matchCriteriaId": "C1AE2401-8A20-46A4-88FD-3643F29B6DC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_17:*:*:*:*:*:*",
"matchCriteriaId": "92560793-428E-4F9A-98CA-CFAAC64B5D1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_18:*:*:*:*:*:*",
"matchCriteriaId": "6CF4D68C-155D-4552-9CB5-736BD68CCB23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_19:*:*:*:*:*:*",
"matchCriteriaId": "C2726E17-7AA5-442C-931C-8440FFC6C164",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_2:*:*:*:*:*:*",
"matchCriteriaId": "CE22919D-02DF-4262-817E-3200A1A08BFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_3:*:*:*:*:*:*",
"matchCriteriaId": "AC98A2D0-C3E6-4742-881A-C5C52896BC5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_4:*:*:*:*:*:*",
"matchCriteriaId": "3C880850-CA2D-4240-ACD9-C59A91EA78AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_5:*:*:*:*:*:*",
"matchCriteriaId": "3DF51F29-C0A3-453A-9170-1FD2756CE2FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_6:*:*:*:*:*:*",
"matchCriteriaId": "DE4594B7-8798-4714-B543-75192EAF1378",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_7:*:*:*:*:*:*",
"matchCriteriaId": "2594DF03-450C-4A92-8FBB-F6BF4D182D36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_8:*:*:*:*:*:*",
"matchCriteriaId": "825A5264-A8D2-4494-A851-C01CC83BFE94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:patch_9:*:*:*:*:*:*",
"matchCriteriaId": "10F3523F-1AAA-411C-9E57-B2734D5AEBD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "E8F59F96-F1CD-4750-94AE-FF80EAA5C461",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_1:*:*:*:*:*:*",
"matchCriteriaId": "CE30DDDB-9362-4122-B3AB-0231E3E0EEFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_10:*:*:*:*:*:*",
"matchCriteriaId": "A155B98E-A0A8-4297-9EAC-67D8C51991F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_11:*:*:*:*:*:*",
"matchCriteriaId": "2D00EC75-5267-4FD4-BA3D-196F0D41F3E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_2:*:*:*:*:*:*",
"matchCriteriaId": "5A64FAB0-BECF-4E88-B137-F18EE13F5DDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_3:*:*:*:*:*:*",
"matchCriteriaId": "1B89CFB2-B9F1-468C-BED2-3B676834C6E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_4:*:*:*:*:*:*",
"matchCriteriaId": "6C6F7E3B-B3C4-4EF6-BEF7-3798CC373195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_5:*:*:*:*:*:*",
"matchCriteriaId": "2199AF29-FB62-4A80-83D9-9C7267CE8ED3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_6:*:*:*:*:*:*",
"matchCriteriaId": "390B3CF7-F004-4889-88D2-0F537E10429C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_7:*:*:*:*:*:*",
"matchCriteriaId": "3DB67225-D7D5-49F6-AA6C-1DFC5EEEC665",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_8:*:*:*:*:*:*",
"matchCriteriaId": "542F1504-A7C6-4E01-9A08-0905BD706596",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:patch_9:*:*:*:*:*:*",
"matchCriteriaId": "9B2B4901-D5EB-43C1-90DC-02735283FA5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "600A95A6-A1F6-45F1-8856-FB1968E084ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:patch_1:*:*:*:*:*:*",
"matchCriteriaId": "54E0EEC2-C4F3-4C79-A587-C72BC6231C27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo XSS Reflejado en Micro Focus Enterprise Developer y Enterprise Server, todas las versiones anteriores a la versi\u00f3n 3.0 Patch Update 20, versi\u00f3n 4.0 Patch Update 12 y versi\u00f3n 5.0 Patch Update 2. La vulnerabilidad podr\u00eda explotarse para redireccionar a un usuario hacia una p\u00e1gina maliciosa o falsificar ciertos tipos de peticiones web."
}
],
"id": "CVE-2019-11651",
"lastModified": "2024-11-21T04:21:31.947",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-10-02T21:15:10.407",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03532232"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03532232"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-10-12 13:29
Modified
2024-11-21 03:45
Severity ?
Summary
Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | enterprise_developer | * | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 3.0 | |
| microfocus | enterprise_developer | 4.0 | |
| microfocus | enterprise_developer | 4.0 | |
| microfocus | enterprise_server | * | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 3.0 | |
| microfocus | enterprise_server | 4.0 | |
| microfocus | enterprise_server | 4.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BA9E86C5-65BB-4297-9906-9CC6C2551238",
"versionEndIncluding": "2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "ADAA9BF3-9B1F-44AE-9D74-B8747979DBA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "4B18C3E3-494E-40A7-92F7-E7B95E9C094F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "78E93020-2C00-490A-9494-20B7797A8A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "87E4305E-043A-4C97-92EA-FFACB69E3DD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:4.0:update1:*:*:*:*:*:*",
"matchCriteriaId": "9AB87ACE-5DD7-480F-BBBE-57B9AFF55A24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6A661E8-AFD3-4B51-9E69-AD709A969ECC",
"versionEndIncluding": "2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "E23C5342-8F45-4675-9401-EBC7287D65CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "6AD523A5-68BB-4397-945E-C95FD0E3229A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F033F27F-DD3C-4AF9-8392-DAA68A0D3E0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "73193F8D-76CC-4377-9F58-DEDF2F270E95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:4.0:update1:*:*:*:*:*:*",
"matchCriteriaId": "F3699E01-261E-46CA-B3D3-A0567C45C7AF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination."
},
{
"lang": "es",
"value": "La gesti\u00f3n incorrecta de un valor inv\u00e1lido para un par\u00e1metro de petici\u00f3n HTTP por parte de Directory Server (tambi\u00e9n conocido como la interfaz de usuario web de Enterprise Server Administration) en Micro Focus Enterprise Developer y Enterprise Server 2.3 Update 2 y anteriores, 3.0 en versiones anteriores al Patch Update 12 y 4.0 en versiones anteriores al Patch Update 2 provoca una desreferencia de puntero NULL (CWE-476) y una subsecuente denegaci\u00f3n de servicio debido a la terminaci\u00f3n del proceso."
}
],
"id": "CVE-2018-12469",
"lastModified": "2024-11-21T03:45:16.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-10-12T13:29:00.307",
"references": [
{
"source": "security@opentext.com",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-476"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-08-21 15:29
Modified
2025-04-20 01:37
Severity ?
Summary
Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | directory_server | - | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_server | * | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server_monitor_and_control | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:directory_server:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3FA6D858-2EBE-4EDB-9178-1FAB470F4E51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E13FE8F0-D7FF-4C77-A0D9-DBE13222B2E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "ADAA9BF3-9B1F-44AE-9D74-B8747979DBA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "4B18C3E3-494E-40A7-92F7-E7B95E9C094F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6A661E8-AFD3-4B51-9E69-AD709A969ECC",
"versionEndIncluding": "2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "E23C5342-8F45-4675-9401-EBC7287D65CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "6AD523A5-68BB-4397-945E-C95FD0E3229A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server_monitor_and_control:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C94B4907-6212-448D-A8F0-E5A8FD701F58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features."
},
{
"lang": "es",
"value": "Las vulnerabilidades de cross-Site Scripting (XSS) reflejado y stored en Directory Server (tambi\u00e9n llamado Enterprise Server Administration web UI) y ESMAC (tambi\u00e9n llamado Enterprise Server Monitor and Control) en Micro Focus Enterprise Developer y Enterprise Server 2.3 y anteriores, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permiten que atacantes remotos autenticados omitan los mecanismos de protecci\u00f3n (CWE-693) y otras caracter\u00edsticas de seguridad."
}
],
"id": "CVE-2017-7421",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-08-21T15:29:00.263",
"references": [
{
"source": "security@opentext.com",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-08-21 15:29
Modified
2025-04-20 01:37
Severity ?
Summary
A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E13FE8F0-D7FF-4C77-A0D9-DBE13222B2E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "ADAA9BF3-9B1F-44AE-9D74-B8747979DBA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "4B18C3E3-494E-40A7-92F7-E7B95E9C094F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1E2A416-8236-43F3-8305-365F0871273D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "E23C5342-8F45-4675-9401-EBC7287D65CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "6AD523A5-68BB-4397-945E-C95FD0E3229A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-Site Request Forgery (CSRF) en esfadmingui en Micro Focus Enterprise Developer y Enterprise Server 2.3, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permite que atacantes remotos sin autenticar falsifiquen peticiones si este componente est\u00e1 configurado. Esto incluye la creaci\u00f3n de nuevas credenciales con privilegios, resultando en una elevaci\u00f3n de privilegios (CWE-275). N\u00f3tese que esfadmingui no est\u00e1 habilitado por defecto."
}
],
"id": "CVE-2017-7423",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-08-21T15:29:00.323",
"references": [
{
"source": "security@opentext.com",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-09-12 19:15
Modified
2024-11-21 08:35
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.
Mitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.
Administrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security@opentext.com | https://portal.microfocus.com/s/article/KM000021287 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://portal.microfocus.com/s/article/KM000021287 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | cobol_server | 7.0 | |
| microfocus | cobol_server | 7.0 | |
| microfocus | cobol_server | 8.0 | |
| microfocus | cobol_server | 8.0 | |
| microfocus | cobol_server | 9.0 | |
| microfocus | enterprise_developer | 7.0 | |
| microfocus | enterprise_developer | 7.0 | |
| microfocus | enterprise_developer | 8.0 | |
| microfocus | enterprise_developer | 8.0 | |
| microfocus | enterprise_developer | 9.0 | |
| microfocus | enterprise_server | 7.0 | |
| microfocus | enterprise_server | 7.0 | |
| microfocus | enterprise_server | 8.0 | |
| microfocus | enterprise_server | 8.0 | |
| microfocus | enterprise_server | 9.0 | |
| microfocus | enterprise_test_server | 7.0 | |
| microfocus | enterprise_test_server | 7.0 | |
| microfocus | enterprise_test_server | 8.0 | |
| microfocus | enterprise_test_server | 8.0 | |
| microfocus | enterprise_test_server | 9.0 | |
| microfocus | visual_cobol | 7.0 | |
| microfocus | visual_cobol | 7.0 | |
| microfocus | visual_cobol | 8.0 | |
| microfocus | visual_cobol | 8.0 | |
| microfocus | visual_cobol | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:cobol_server:7.0:patch_update_19:*:*:*:*:*:*",
"matchCriteriaId": "051D2BF3-E6AF-432D-A280-ECEE8550868F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:cobol_server:7.0:patch_update_20:*:*:*:*:*:*",
"matchCriteriaId": "14458049-2D88-4185-B005-750078A50B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:cobol_server:8.0:patch_update_8:*:*:*:*:*:*",
"matchCriteriaId": "41FC671B-3CE4-4D60-9EE6-77392961F101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:cobol_server:8.0:patch_update_9:*:*:*:*:*:*",
"matchCriteriaId": "74A7D0F5-5FAD-45BC-BF96-0CAD4B45B672",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:cobol_server:9.0:patch_update_1:*:*:*:*:*:*",
"matchCriteriaId": "2D74FA59-98F4-4BC4-A2A9-E0BBEC527563",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:7.0:patch_update_19:*:*:*:*:*:*",
"matchCriteriaId": "6B6400C4-4DBA-4289-89D9-58147774D63B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:7.0:patch_update_20:*:*:*:*:*:*",
"matchCriteriaId": "A64B3C61-3D58-4E50-AD4A-118F7E490504",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:8.0:patch_update_8:*:*:*:*:*:*",
"matchCriteriaId": "3AFC7ED5-CF0A-4764-ABF5-6643C346B19F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:8.0:patch_update_9:*:*:*:*:*:*",
"matchCriteriaId": "7201C9F4-16BB-484E-9178-6355348C3B95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:9.0:patch_update_1:*:*:*:*:*:*",
"matchCriteriaId": "029A2BF3-3692-4B35-A0EF-ED1740BF6986",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:7.0:patch_update_19:*:*:*:*:*:*",
"matchCriteriaId": "832BDC0E-2BA9-403C-BBFE-991698CF2A96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:7.0:patch_update_20:*:*:*:*:*:*",
"matchCriteriaId": "81B56797-AF56-4F6A-9C3E-9444E4F2886E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:8.0:patch_update_8:*:*:*:*:*:*",
"matchCriteriaId": "1BCE1129-4573-4720-9F25-9F0D41808B71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:8.0:patch_update_9:*:*:*:*:*:*",
"matchCriteriaId": "BD5D4016-28FD-4818-884F-0D24D13C99EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:9.0:patch_update_1:*:*:*:*:*:*",
"matchCriteriaId": "E5631EB2-3A88-4DC4-B636-65EC1F021924",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_test_server:7.0:patch_update_19:*:*:*:*:*:*",
"matchCriteriaId": "D2293874-EC8A-4BAC-B0F7-F5B3E50B39FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_test_server:7.0:patch_update_20:*:*:*:*:*:*",
"matchCriteriaId": "50CD685C-7DB2-49FA-9787-8222AFA7EC44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_test_server:8.0:patch_update_8:*:*:*:*:*:*",
"matchCriteriaId": "D2E0598D-B7B2-4419-805E-6F116230D74C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_test_server:8.0:patch_update_9:*:*:*:*:*:*",
"matchCriteriaId": "2C8C6917-6B5C-449F-AD59-2ADBCCAA2136",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_test_server:9.0:patch_update_1:*:*:*:*:*:*",
"matchCriteriaId": "B7EDD7A0-0C20-4560-8D3A-0C6FC14C15CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:visual_cobol:7.0:patch_update_19:*:*:*:*:*:*",
"matchCriteriaId": "7FB32C35-E606-49B2-A5AE-01C5E4840956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:visual_cobol:7.0:patch_update_20:*:*:*:*:*:*",
"matchCriteriaId": "9D0E7EF8-2FF4-4310-85CA-B7943E37650C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:visual_cobol:8.0:patch_update_8:*:*:*:*:*:*",
"matchCriteriaId": "ECFE25B2-E3D1-410B-A596-EB973DE458A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:visual_cobol:8.0:patch_update_9:*:*:*:*:*:*",
"matchCriteriaId": "5D593286-E24C-4903-842A-EE5EFA1FF1C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:visual_cobol:9.0:patch_update_1:*:*:*:*:*:*",
"matchCriteriaId": "7ED74B78-831A-4799-8507-8B1AD3C02DFB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates 19 and 20, 8.0 patch updates 8 and 9, and 9.0 patch update 1, when LDAP-based authentication is used with certain configurations. When the vulnerability is active, authentication succeeds with any valid username, regardless of whether the password is correct; it may also succeed with an invalid username (and any password). This allows an attacker with access to the product to impersonate any user.\n\nMitigations: The issue is corrected in the upcoming patch update for each affected product. Product overlays and workaround instructions are available through OpenText Support. The vulnerable configurations are believed to be uncommon.\n\nAdministrators can test for the vulnerability in their installations by attempting to sign on to a Visual COBOL or Enterprise Server component such as ESCWA using a valid username and incorrect password.\n"
},
{
"lang": "es",
"value": "La autenticaci\u00f3n de usuario con credenciales de nombre de usuario y contrase\u00f1a no es efectiva en OpenText (Micro Focus), Visual COBOL, COBOL Server, Enterprise Developer y Enterprise Server (incluidas variantes de productos como Enterprise Test Server), versiones 7.0, actualizaciones de parches 19 y 20, actualizaciones de parches 8.0 8. y 9, y 9.0 update 1 del parche, cuando se utiliza la autenticaci\u00f3n basada en LDAP con ciertas configuraciones. Cuando la vulnerabilidad est\u00e1 activa, la autenticaci\u00f3n se realiza correctamente con cualquier nombre de usuario v\u00e1lido, independientemente de si la contrase\u00f1a es correcta; tambi\u00e9n puede tener \u00e9xito con un nombre de usuario no v\u00e1lido (y cualquier contrase\u00f1a). Esto permite que un atacante con acceso al producto se haga pasar por cualquier usuario. Mitigaciones: el problema se corrige en la pr\u00f3xima actualizaci\u00f3n del parche para cada producto afectado. Las superposiciones de productos y las instrucciones para solucionar el problema est\u00e1n disponibles a trav\u00e9s del soporte de OpenText. Se cree que las configuraciones vulnerables son poco comunes. Los administradores pueden probar la vulnerabilidad en sus instalaciones intentando iniciar sesi\u00f3n en un componente de Visual COBOL o Enterprise Server como ESCWA utilizando un nombre de usuario v\u00e1lido y una contrase\u00f1a incorrecta."
}
],
"id": "CVE-2023-4501",
"lastModified": "2024-11-21T08:35:18.020",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-09-12T19:15:36.333",
"references": [
{
"source": "security@opentext.com",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.microfocus.com/s/article/KM000021287"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.microfocus.com/s/article/KM000021287"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-253"
},
{
"lang": "en",
"value": "CWE-287"
},
{
"lang": "en",
"value": "CWE-305"
},
{
"lang": "en",
"value": "CWE-358"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-08-21 15:29
Modified
2025-04-20 01:37
Severity ?
Summary
A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | directory_server | - | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_server | * | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server_monitor_and_control | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:directory_server:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3FA6D858-2EBE-4EDB-9178-1FAB470F4E51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E13FE8F0-D7FF-4C77-A0D9-DBE13222B2E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "ADAA9BF3-9B1F-44AE-9D74-B8747979DBA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "4B18C3E3-494E-40A7-92F7-E7B95E9C094F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6A661E8-AFD3-4B51-9E69-AD709A969ECC",
"versionEndIncluding": "2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "E23C5342-8F45-4675-9401-EBC7287D65CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "6AD523A5-68BB-4397-945E-C95FD0E3229A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server_monitor_and_control:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C94B4907-6212-448D-A8F0-E5A8FD701F58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-Site Request Forgery (CWE-352) en Directory Server (tambi\u00e9n llamado Enterprise Server Administration web UI) en Micro Focus Enterprise Developer y Enterprise Server 2.3 y anteriores, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permite que atacantes remotos sin autenticar vean y alteren (CWE-275) la informaci\u00f3n de configuraci\u00f3n e inyecten comandos del sistema operativo (CWE-78) mediante peticiones falsificadas."
}
],
"id": "CVE-2017-5187",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-08-21T15:29:00.183",
"references": [
{
"source": "security@opentext.com",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-18 14:15
Modified
2024-11-21 05:40
Severity ?
Summary
Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | enterprise_developer | 5.0 | |
| microfocus | enterprise_developer | 5.0 | |
| microfocus | enterprise_developer | 5.0 | |
| microfocus | enterprise_developer | 5.0 | |
| microfocus | enterprise_developer | 5.0 | |
| microfocus | enterprise_developer | 5.0 | |
| microfocus | enterprise_developer | 5.0 | |
| microfocus | enterprise_developer | 5.0 | |
| microfocus | enterprise_server | 5.0 | |
| microfocus | enterprise_server | 5.0 | |
| microfocus | enterprise_server | 5.0 | |
| microfocus | enterprise_server | 5.0 | |
| microfocus | enterprise_server | 5.0 | |
| microfocus | enterprise_server | 5.0 | |
| microfocus | enterprise_server | 5.0 | |
| microfocus | enterprise_server | 5.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "3C73BDBE-2719-4020-B953-1580BB78CB0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p1:*:*:*:*:*:*",
"matchCriteriaId": "7620CD64-03C0-44C3-BFD6-82C5CE5835AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p2:*:*:*:*:*:*",
"matchCriteriaId": "A8C8BC9D-0755-48BB-8CDD-B906C1197981",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p3:*:*:*:*:*:*",
"matchCriteriaId": "EC2BBA40-5BD9-4EE0-96A0-F1AC2BE02245",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p4:*:*:*:*:*:*",
"matchCriteriaId": "658DE765-305D-43BC-B1F6-290B6C203CF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p5:*:*:*:*:*:*",
"matchCriteriaId": "87B914AA-7BAE-47DF-A74D-27D9925A08CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p6:*:*:*:*:*:*",
"matchCriteriaId": "4D4B2B00-3247-45C6-B0A1-8D12ADF6D5EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p7:*:*:*:*:*:*",
"matchCriteriaId": "E1743FFA-D530-4FEA-A692-221312123E46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "600A95A6-A1F6-45F1-8856-FB1968E084ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p1:*:*:*:*:*:*",
"matchCriteriaId": "6784996D-C065-49FF-8474-B3BEF0F3DA9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p2:*:*:*:*:*:*",
"matchCriteriaId": "AF442860-F76E-47AC-BA83-DD9B6317E52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p3:*:*:*:*:*:*",
"matchCriteriaId": "69104963-85AF-4B27-909E-103F8083D048",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p4:*:*:*:*:*:*",
"matchCriteriaId": "01EDE33A-184F-44E4-8487-0D3DD875E255",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p5:*:*:*:*:*:*",
"matchCriteriaId": "9E51F296-95D1-4E53-BE4E-58681763E10A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p6:*:*:*:*:*:*",
"matchCriteriaId": "76C75510-91FD-426B-9AE8-487E956236AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p7:*:*:*:*:*:*",
"matchCriteriaId": "0FF366C0-1C8C-4332-ACA6-5EF2793E9341",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS)."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross Site scripting en Micro Focus Enterprise Server y el desarrollador Enterprise, afecta a todas las versiones anteriores a 5.0 Patch Update 8. La vulnerabilidad podr\u00eda permitir a un atacante desencadenar acciones administrativas cuando un administrador visualizara datos maliciosos dejados por el atacante (XSS almacenado) o siguiera un enlace malicioso (XSS reflejado)."
}
],
"id": "CVE-2020-9524",
"lastModified": "2024-11-21T05:40:48.133",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-18T14:15:12.217",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03640252"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03640252"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-08-21 15:29
Modified
2025-04-20 01:37
Severity ?
Summary
A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is configured. Note esfadmingui is not enabled by default.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_developer | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 | |
| microfocus | enterprise_server | 2.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E13FE8F0-D7FF-4C77-A0D9-DBE13222B2E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "ADAA9BF3-9B1F-44AE-9D74-B8747979DBA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "4B18C3E3-494E-40A7-92F7-E7B95E9C094F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E1E2A416-8236-43F3-8305-365F0871273D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update1:*:*:*:*:*:*",
"matchCriteriaId": "E23C5342-8F45-4675-9401-EBC7287D65CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update2:*:*:*:*:*:*",
"matchCriteriaId": "6AD523A5-68BB-4397-945E-C95FD0E3229A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Path Traversal (CWE-22) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote authenticated users to download arbitrary files from a system running the product, if this component is configured. Note esfadmingui is not enabled by default."
},
{
"lang": "es",
"value": "Una vulnerabilidad de salto de directorio en esfadmingui en Micro Focus Enterprise Developer y Enterprise Server 2.3, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permite que atacantes remotos autenticados descarguen archivos arbitrarios desde un sistema ejecutando el producto si este componente est\u00e1 configurado. N\u00f3tese que esfadmingui no est\u00e1 habilitado por defecto."
}
],
"id": "CVE-2017-7424",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-08-21T15:29:00.357",
"references": [
{
"source": "security@opentext.com",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-07-20 14:15
Modified
2024-11-21 08:03
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server.
An attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting users’ permissions in the Micro Focus Directory Server also reduce the exposure to this issue.
Given the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | cobol_server | 6.0 | |
| microfocus | cobol_server | 7.0 | |
| microfocus | cobol_server | 8.0 | |
| microfocus | enterprise_developer | 6.0 | |
| microfocus | enterprise_developer | 7.0 | |
| microfocus | enterprise_developer | 8.0 | |
| microfocus | enterprise_server | 6.0 | |
| microfocus | enterprise_server | 7.0 | |
| microfocus | enterprise_server | 8.0 | |
| microfocus | enterprise_test_server | 6.0 | |
| microfocus | enterprise_test_server | 7.0 | |
| microfocus | enterprise_test_server | 8.0 | |
| microfocus | visual_cobol | 6.0 | |
| microfocus | visual_cobol | 7.0 | |
| microfocus | visual_cobol | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:cobol_server:6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "3126671E-BE13-4240-B51F-C6FC9F3BABCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:cobol_server:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "BD7DBDAA-E0C3-44E7-897F-59ED52990741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:cobol_server:8.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1A2BBD33-F853-494F-98FA-F5436AA6D4B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EF035EDF-2882-49C0-BABA-BA74169077CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "9E523EE6-1949-4890-97AD-6C06062115B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_developer:8.0:-:*:*:*:*:*:*",
"matchCriteriaId": "2E411AFF-F1FF-4548-B2F0-DC15016FCACF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "681ED2CA-D5DE-4828-AD4C-22042927AD56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "B43620BE-A850-4CB8-958E-802744DAE5EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_server:8.0:-:*:*:*:*:*:*",
"matchCriteriaId": "1F47D3F3-6779-4501-B53D-A423F325BC7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_test_server:6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "F25363C5-6E2E-4A96-A6C7-4111ECCDC452",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_test_server:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "ADC1491E-5BCB-4FB2-864E-3246C5F2ABEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:enterprise_test_server:8.0:-:*:*:*:*:*:*",
"matchCriteriaId": "08FD4630-9410-4335-9F07-A05D92CAB9B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:visual_cobol:6.0:-:*:*:*:*:*:*",
"matchCriteriaId": "A60B87CD-A7FC-4761-A2F3-702EDE8AFA2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:visual_cobol:7.0:-:*:*:*:*:*:*",
"matchCriteriaId": "3440F8D5-194F-4592-A847-859353250DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:visual_cobol:8.0:-:*:*:*:*:*:*",
"matchCriteriaId": "512DEAD9-6ABF-42FC-AD28-6F1BD039B8D9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nA potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server.\nAn attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting users\u00e2\u20ac\u2122 permissions in the Micro Focus Directory Server also reduce the exposure to this issue.\n\nGiven the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.\n\n"
}
],
"id": "CVE-2023-32265",
"lastModified": "2024-11-21T08:03:00.267",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.2,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-07-20T14:15:11.193",
"references": [
{
"source": "security@opentext.com",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.microfocus.com/s/article/KM000019323?language=en_US"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://portal.microfocus.com/s/article/KM000019323?language=en_US"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}