Vulnerability CVE-2018-6499


Published: 2018-08-30

Description:
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.

Type:

CWE-94

(Improper Control of Generation of Code ('Code Injection'))

Vendor: Microfocus
Product: Network operations management 
Version:
2018.05
2018.02
2017.11
Product: Service management automation 
Version:
2018.05
2018.02
2017.11
Product: Hybrid cloud management 
Version:
2018.05
2018.02
2017.11
Product: Operations bridge 
Version:
2018.05
2018.02
2017.11
Product: Data center automation 
Version:
2018.05
2018.02
2017.11
2017.09
2017.08
2017.05
2017.01
Product: Unified functional testing 
Version: 12.50;
Product: Network virtualization 
Version: 12.50;
Product: Service virtualization 
Version: 1.00;

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en&cc=us&hpappid=206728_SSO_PRO
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726

Related CVE
CVE-2019-11647
A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack.
CVE-2019-11649
Cross-Site Scripting vulnerability in Micro Focus Fortify Software Security Center Server, versions 17.2, 18.1, 18.2, has been identified in Micro Focus Software Security Center. The vulnerability could be exploited to execute JavaScript code in user...
CVE-2019-3477
Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.
CVE-2019-11646
Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61. This vulnerability could allow Remote unauthorized...
CVE-2016-1600
The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability.
CVE-2019-3490
A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. Th...
CVE-2019-3493
A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20, 9.21, 10.00, 10.10, 10.20, 10.30, 10.40, 10.50, 2018.05, 2018.08, 2018.11, and Micro Focus Network Operations Management (NOM) all versions. The v...
CVE-2019-3489
An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method. The vulnerability could be exploited by an unauthenti...

Copyright 2019, cxsecurity.com

 

Back to Top