PT-2017-16369 · Micro Focus · Open Enterprise Server

Published 2017-01-23 · Updated 2020-02-24 · CVE-2017-5182

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Enterprise Server (OES) versions prior to OES2015 SP1 Maintenance Update 11080 Open Enterprise Server (OES) versions prior to OES2015 Maintenance Update 11079 Open Enterprise Server (OES) versions prior to OES11 SP3 Maintenance Update 11078 Open Enterprise Server (OES) versions prior to OES11 SP2 Maintenance Update 11077

Description The issue allows unauthenticated remote attackers to read any arbitrary file via a specially crafted URL, enabling complete directory traversal and total information disclosure.

Recommendations For OES2015 SP1, apply Maintenance Update 11080 to resolve the issue. For OES2015, apply Maintenance Update 11079 to resolve the issue. For OES11 SP3, apply Maintenance Update 11078 to resolve the issue. For OES11 SP2, apply Maintenance Update 11077 to resolve the issue.

Fix

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

Related Identifiers

CVE-2017-5182

Affected Products

Open Enterprise Server

References · 5

• https://osv.dev/vulnerability/CVE-2017-5182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5182 · Security Note
• https://novell.com/support/kb/doc.php?id=7018503 · Note
• http://securityfocus.com/bid/95743 · Note
• http://securitytracker.com/id/1037689 · Note