CVE-2017-7420

Published: Aug 21, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275).

Affected (7)

Products: Microfocus: Enterprise Developer, Enterprise Server, Enterprise Server Monitor And Control

Microfocus

3 products

Enterprise Developer

Enterprise Server

Enterprise Server Monitor And Control

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Microfocus Enterprise Developer	Version 2.3
Microfocus Enterprise Developer	Version 2.3 update1
Microfocus Enterprise Developer	Version 2.3 update2
Microfocus Enterprise Server	Up to 2.3
Microfocus Enterprise Server	Version 2.3 update1
Microfocus Enterprise Server	Version 2.3 update2
Microfocus Enterprise Server Monitor And Control	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017

Source: security@opentext.com

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.