CVE-2018-12465
Remote Code Execution in Micro Focus Secure Messaging Gateway
- State
- Published
- Severity
- 9.1 Critical
- Published
- Jun 29, 2018
- Updated
- Sep 16, 2024
- Reserved
- Jun 15, 2018
Description
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that used GWAVA product name (i.e. GWAVA 6.5).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.1 Critical | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | microfocus |
Weaknesses
- CWE-77 OS command injection (CWE-77)
Affected Products
| Product | Versions |
|---|---|
Secure Messaging GatewayMicro Focus |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.