CVE-2018-7681

Published: Jun 21, 2018Modified: Jun 17, 2026

4.8

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system.

Affected (1)

Products: Microfocus: Solutions Business Manager

Microfocus

1 product

Solutions Business Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microfocus Solutions Business Manager	Before 11.4

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm

Source: security@opentext.com

http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.