Path Traversal Vulnerability in Micro Focus Enterprise Developer and Server
CVE-2017-7424

6.5MEDIUM

Key Information:

Vendor

Micro Focus

Status
Micro Focus Enterprise Developer, Micro Focus Enterprise Server
Vendor
CVE Published:
21 August 2017

What is CVE-2017-7424?

A Path Traversal vulnerability exists in the esfadmingui component of Micro Focus Enterprise Developer and Enterprise Server. This issue allows remote authenticated users to exploit the vulnerability to download arbitrary files from the underlying system, provided the esfadmingui component is enabled. Note that this component is not enabled by default, but if configured, it poses a significant risk as it grants access to sensitive files. Proper security measures and configurations should be reviewed to mitigate potential exploitation.

Affected Version(s)

Micro Focus Enterprise Developer, Micro Focus Enterprise Server All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9

References

https://community.microfocus.com/microfocus/mainframe_sol...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.