← Back

CVE-2017-5187

nvd nist
Published: Aug 21, 2017Modified: May 13, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.

Affected (8)

Microfocus
4 products
Directory Server
Enterprise Developer
Enterprise Server
Enterprise Server Monitor And Control
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Directory Server
All versions
Microfocus
Enterprise Developer
Version 2.3
Enterprise Developer
Version 2.3 update1
Enterprise Developer
Version 2.3 update2
Microfocus
Enterprise Server
version ≤ 2.3
Enterprise Server
Version 2.3 update1
Enterprise Server
Version 2.3 update2
Enterprise Server Monitor And Control
All versions

Related CWEs

CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

Source: security@opentext.com
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.