PT-2018-11200 · Micro Focus · Enterprise Developer+2

Publicado 2018-10-12 · Atualizado 2019-10-09 · CVE-2018-12469

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Micro Focus Enterprise Developer and Enterprise Server versions 2.3 Update 2 and earlier, 3.0 before Patch Update 12, 4.0 before Patch Update 2

Description The issue arises from the incorrect handling of an invalid value for an HTTP request parameter by the Directory Server, also known as the Enterprise Server Administration web UI. This leads to a null pointer dereference and results in a denial of service due to process termination.

Recommendations For versions 2.3 Update 2 and earlier, apply the necessary patches to update beyond these versions. For version 3.0, apply Patch Update 12 or later. For version 4.0, apply Patch Update 2 or later.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2018-12469

Produtos afetados

Directory Server

Enterprise Developer

Enterprise Server

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-12469 · Aviso do Fabricante
• https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-12469 · Nota de Segurança