CVE-2017-5187
Last modified
CVE-2017-5187 is a vulnerability of currently unknown severity. A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.. EPSS estimates a 0.75% chance of exploitation in the next 30 days.
Description
A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microfocus | Directory Server | All versions | — |
| Microfocus | Enterprise Developer | 2.3 | — |
| Microfocus | Enterprise Server | <= 2.3 | — |
| Microfocus | Enterprise Server | 2.3 | Update1 |
| Microfocus | Enterprise Server Monitor And Control | All versions | — |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-5187?
How severe is CVE-2017-5187?
How do I fix CVE-2017-5187?
Are you affected by CVE-2017-5187?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST