PT-2017-17725 · Micro Focus · Micro Focus Enterprise Server+2

Publicado 2017-08-21 · Atualizado 2019-10-09 · CVE-2017-7420

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Micro Focus Enterprise Developer and Enterprise Server versions prior to 2.3 Update 2 Hotfix 9 Micro Focus Enterprise Developer and Enterprise Server version 2.3 Micro Focus Enterprise Developer and Enterprise Server version 2.3 Update 1 through 2.3 Update 1 before Hotfix 8

Description The issue allows remote unauthenticated attackers to bypass authentication and view and alter configuration information, as well as alter the state of the running product. This is due to an Authentication Bypass vulnerability in ESMAC.

Recommendations For Micro Focus Enterprise Developer and Enterprise Server versions prior to 2.3 Update 2 Hotfix 9, apply Hotfix 9 or later to resolve the issue. For Micro Focus Enterprise Developer and Enterprise Server version 2.3, apply Update 1 and then Hotfix 8 or later to resolve the issue. For Micro Focus Enterprise Developer and Enterprise Server version 2.3 Update 1 before Hotfix 8, apply Hotfix 8 or later to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-7420

Produtos afetados

Esmac

Micro Focus Enterprise Developer

Micro Focus Enterprise Server

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-7420 · Aviso do Fabricante
• https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7420 · Nota de Segurança