« Volver al listado

CVE-2016-5765

Estado: ModificadaMedia (6.5)—

Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Microfocus — Host Access Management AND Security ServerMicrofocus — Reflection FOR THE WEBMicrofocus — Reflection Security GatewayMicrofocus — Reflection ZFE

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-5765",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Micro Focus MSS, RWeb, ZFE, RSG 1.x, 2.x, 12.x",
          "versions": [
            {
              "status": "affected",
              "version": "Micro Focus MSS, RWeb, ZFE, RSG 1.x, 2.x, 12.x"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-11-29T11:59:00.177",
  "references": [
    {
      "url": "http://support.attachmate.com/techdocs/1704.html",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94579",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-16-618",
      "source": "security@opentext.com"
    },
    {
      "url": "http://support.attachmate.com/techdocs/1704.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/94579",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-16-618",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14."
    },
    {
      "lang": "es",
      "value": "Administrative Server en Micro Focus Host Access Management y Security Server (MSS) y Reflection para la Web (RWeb) y Reflection Security Gateway (RSG) y Reflection ZFE (ZFE) permite a atacantes remotos no autenticados leer archivos arbitrarios a través de una URL especialmente manipulada que permite recorrido de directorio limitado. Se aplica a MSS 12.3 en versiones anteriores a 12.3.326 y MSS 12.2 en versiones anteriores a 12.2.342 y RSG 12.1 en versiones anteriores a 12.1.362 y RWeb 12.3 en versiones anteriores a 12.3.312 y RWeb 12.2 en versiones anteriores a 12.2.342 y RWeb 12.1 en versiones anteriores a 12.1.362 y ZFE 2.0.1 en versiones anteriores a 2.0.1.18 y ZFE 2.0.0 en versiones anteriores a 2.0.0.52 y ZFE 1.4.0 en versiones anteriores a 1.4.0.14."
    }
  ],
  "lastModified": "2026-06-17T00:50:00.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:host_access_management_and_security_server:12.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A5691B4-63CE-4782-AB99-BE5A853B4A80"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:host_access_management_and_security_server:12.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40A6B3A9-4672-44B5-BDE6-20EF4F98019E"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:reflection_for_the_web:12.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F8A9900-EEA0-403E-84B9-ACD1A878595A"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:reflection_for_the_web:12.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3A8D101-CCDF-499E-927A-65998AF4054A"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:reflection_for_the_web:12.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2B238C4-773A-45FF-9BC4-D96E332E9B6F"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:reflection_security_gateway:12.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB5AFD78-9A4E-4772-BE25-FD1CDBEC5589"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:reflection_zfe:1.4.0.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8B1548B-D36F-458B-B1E4-9EBF56CB038C"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:reflection_zfe:2.0.0.52:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4440DFA4-8160-486B-AAA9-614C72B93371"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:reflection_zfe:2.0.1.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EF4535F-A798-47D9-A33F-81DAD681493E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}