CVE-2017-7423

Published: Aug 21, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default.

Affected (6)

Products: Microfocus: Enterprise Developer, Enterprise Server

Microfocus

2 products

Enterprise Developer

Enterprise Server

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Microfocus Enterprise Developer	Version 2.3
Microfocus Enterprise Developer	Version 2.3 update1
Microfocus Enterprise Developer	Version 2.3 update2
Microfocus Enterprise Server	Version 2.3
Microfocus Enterprise Server	Version 2.3 update1
Microfocus Enterprise Server	Version 2.3 update2

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017

Source: security@opentext.com

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.