Lucene search

[email protected]CVE-2016-5765

HistoryNov 29, 2016 - 11:59 a.m.

CVE-2016-5765

2016-11-2911:59:00

CWE-200

CWE-22

[email protected]

web.nvd.nist.gov

cve-2016-5765

administrative server

micro focus

host access management

security server

mss

reflection for the web

rweb

reflection security gateway

rsg

reflection zfe

zfe

directory traversal

nvd

vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.136 Low

EPSS

Percentile

95.7%

JSON

Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14.

Affected configurations

NVD

Node

microfocushost_access_management_and_security_serverMatch12.2

microfocushost_access_management_and_security_serverMatch12.3

microfocusreflection_for_the_webMatch12.1

microfocusreflection_for_the_webMatch12.2

microfocusreflection_for_the_webMatch12.3

microfocusreflection_security_gatewayMatch12.1

microfocusreflection_zfeMatch1.4.0.14

microfocusreflection_zfeMatch2.0.0.52

microfocusreflection_zfeMatch2.0.1.18

CPENameOperatorVersion
microfocus:host_access_management_and_security_servermicrofocus host access management and security servereq12.2
microfocus:host_access_management_and_security_servermicrofocus host access management and security servereq12.3
microfocus:reflection_for_the_webmicrofocus reflection for the webeq12.1
microfocus:reflection_for_the_webmicrofocus reflection for the webeq12.2
microfocus:reflection_for_the_webmicrofocus reflection for the webeq12.3
microfocus:reflection_security_gatewaymicrofocus reflection security gatewayeq12.1
microfocus:reflection_zfemicrofocus reflection zfeeq1.4.0.14
microfocus:reflection_zfemicrofocus reflection zfeeq2.0.0.52
microfocus:reflection_zfemicrofocus reflection zfeeq2.0.1.18

CPE	Name	Operator	Version
microfocus:host_access_management_and_security_server	microfocus host access management and security server	eq	12.2
microfocus:host_access_management_and_security_server	microfocus host access management and security server	eq	12.3
microfocus:reflection_for_the_web	microfocus reflection for the web	eq	12.1
microfocus:reflection_for_the_web	microfocus reflection for the web	eq	12.2
microfocus:reflection_for_the_web	microfocus reflection for the web	eq	12.3
microfocus:reflection_security_gateway	microfocus reflection security gateway	eq	12.1
microfocus:reflection_zfe	microfocus reflection zfe	eq	1.4.0.14
microfocus:reflection_zfe	microfocus reflection zfe	eq	2.0.0.52
microfocus:reflection_zfe	microfocus reflection zfe	eq	2.0.1.18

CNA Affected

[
  {
    "product": "Micro Focus MSS, RWeb, ZFE, RSG 1.x, 2.x, 12.x",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Micro Focus MSS, RWeb, ZFE, RSG 1.x, 2.x, 12.x"
      }
    ]
  }
]

References

support.attachmate.com/techdocs/1704.html

www.securityfocus.com/bid/94579

www.zerodayinitiative.com/advisories/ZDI-16-618

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.136 Low

EPSS

Percentile

95.7%

JSON

Related for CVE-2016-5765

zdi1 nvd1 prion1 cvelist1