Critical severity · published Jun 21, 2018
CVE-2018-7679
Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of…
9.8
CVSS
2.3%
EPSS
No
On KEV
Description
Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote code execution.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Solutions Business Manager · Microfocus
before 11.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7679
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7679
help.serena.com
http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm
More from Solutions Business Manager
9.8
CVE-2018-19641
Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5
9.8
CVE-2018-19645
Solutions Business Manager (SBM) Authentication Bypass Issue in Version prior to 11.5
8.0
CVE-2019-18945
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability
8.0
CVE-2019-18943
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations
7.5
CVE-2018-19643
Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5