PT-2018-11199 · Micro Focus · Groupwise

Published 2018-08-01 · Updated 2019-10-09 · CVE-2018-12468

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Micro Focus GroupWise versions prior to 18.0.2

Description A remote attacker authenticated as an administrator may be able to upload files to an arbitrary path on the server, potentially resulting in remote code execution.

Recommendations For versions prior to 18.0.2, update to version 18.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration console to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-12468

Affected Products

Groupwise

References · 3

• https://osv.dev/vulnerability/CVE-2018-12468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12468 · Security Note
• https://novell.com/support/kb/doc.php?id=7023223 · Note