Lucene search

[email protected]CVE-2017-5182

HistoryJan 23, 2017 - 3:59 p.m.

CVE-2017-5182

2017-01-2315:59:00

CWE-200

CWE-22

[email protected]

web.nvd.nist.gov

cve-2017-5182

remote manager

open enterprise server

oes

unauthenticated

directory traversal

information disclosure

vulnerability

nvd

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.018 Low

EPSS

Percentile

88.1%

JSON

Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to OES2015 SP1 before Maintenance Update 11080, OES2015 before Maintenance Update 11079, OES11 SP3 before Maintenance Update 11078, OES11 SP2 before Maintenance Update 11077).

Affected configurations

NVD

Node

novellopen_enterprise_serverMatch2.0linux_kernel

novellopen_enterprise_serverMatch2015linux_kernel

novellopen_enterprise_serverMatch11.0linux_kernel

CPENameOperatorVersion
novell:open_enterprise_servernovell open enterprise servereq2.0
novell:open_enterprise_servernovell open enterprise servereq2015
novell:open_enterprise_servernovell open enterprise servereq11.0

CPE	Name	Operator	Version
novell:open_enterprise_server	novell open enterprise server	eq	2.0
novell:open_enterprise_server	novell open enterprise server	eq	2015
novell:open_enterprise_server	novell open enterprise server	eq	11.0

CNA Affected

[
  {
    "product": "Open Enterprise Server",
    "vendor": "Micro Focus International",
    "versions": [
      {
        "status": "affected",
        "version": "All"
      }
    ]
  }
]

References

www.securityfocus.com/bid/95743

www.securitytracker.com/id/1037689

www.novell.com/support/kb/doc.php?id=7018503

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.018 Low

EPSS

Percentile

88.1%

JSON

Related for CVE-2017-5182

cvelist1 nvd1 prion1