CVE-2018-12469

Published: Oct 12, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination.

Affected (12)

Products: Microfocus: Enterprise Developer, Enterprise Server

Microfocus

2 products

Enterprise Developer

Enterprise Server

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Microfocus Enterprise Developer	Up to 2.3
Microfocus Enterprise Developer	Version 2.3 update1
Microfocus Enterprise Developer	Version 2.3 update2
Microfocus Enterprise Developer	Version 3.0
Microfocus Enterprise Developer	Version 4.0
Microfocus Enterprise Developer	Version 4.0 update1
Microfocus Enterprise Server	Up to 2.3
Microfocus Enterprise Server	Version 2.3 update1
Microfocus Enterprise Server	Version 2.3 update2
Microfocus Enterprise Server	Version 3.0
Microfocus Enterprise Server	Version 4.0
Microfocus Enterprise Server	Version 4.0 update1

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (2)

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018

Source: security@opentext.com

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.