PT-2018-18205 · Micro Focus+1 · Micro Focus Solutions Business Manager+1

Published 2018-06-21 · Updated 2021-04-09 · CVE-2018-7679

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4

Description The issue arises when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, which could lead to remote code execution.

Recommendations For versions prior to 11.4, ensure that ASP.NET is configured to validate the contents of user avatar images and remove execute permission on the virtual directories to prevent remote code execution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-7679

Affected Products

Asp.Net

Micro Focus Solutions Business Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7679 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7679 · Vendor Advisory
• http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm · Note