Micro Focus Enterprise Developer/Enterprise Server up to 2.3 Directory Server cross-site request forgery

Summaryinfo

A vulnerability described as problematic has been identified in Micro Focus Enterprise Developer and Enterprise Server up to 2.3. The affected element is an unknown function of the component Directory Server. Executing a manipulation can lead to cross-site request forgery. This vulnerability appears as CVE-2017-5187. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in Micro Focus Enterprise Developer and Enterprise Server up to 2.3 and classified as problematic. This vulnerability affects an unknown code block of the component Directory Server. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. CVE summarizes:

A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.

The bug was discovered 04/05/2017. The weakness was presented 08/21/2017 (Website). The advisory is shared for download at community.microfocus.com. This vulnerability was named CVE-2017-5187 since 01/06/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 138 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-105630, VDB-105631, VDB-105632 and VDB-105633 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Micro Focus

Name

• Enterprise Developer
• Enterprise Server

Version

• 2.0
• 2.1
• 2.2
• 2.3

License

• commercial

Website

• Vendor: https://www.microfocus.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion