« Volver al listado

CVE-2017-7423

Estado: ModificadaAlta (8.8)—

A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microfocus — Enterprise DeveloperMicrofocus — Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-7423",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "Micro Focus",
          "product": "Micro Focus Enterprise Developer, Micro Focus Enterprise Server",
          "versions": [
            {
              "status": "affected",
              "version": "2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-08-21T15:29:00.323",
  "references": [
    {
      "url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017",
      "source": "security@opentext.com"
    },
    {
      "url": "https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@opentext.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to forge requests, if this component is configured. This includes creating new privileged credentials, resulting in privilege elevation (CWE-275). Note esfadmingui is not enabled by default."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Cross-Site Request Forgery (CSRF) en esfadmingui en Micro Focus Enterprise Developer y Enterprise Server 2.3, 2.3 Update 1 en versiones anteriores a Hotfix 8, y 2.3 Update 2 en versiones anteriores a Hotfix 9 permite que atacantes remotos sin autenticar falsifiquen peticiones si este componente está configurado. Esto incluye la creación de nuevas credenciales con privilegios, resultando en una elevación de privilegios (CWE-275). Nótese que esfadmingui no está habilitado por defecto."
    }
  ],
  "lastModified": "2026-06-17T01:24:19.410",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E13FE8F0-D7FF-4C77-A0D9-DBE13222B2E4"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADAA9BF3-9B1F-44AE-9D74-B8747979DBA8"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:2.3:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B18C3E3-494E-40A7-92F7-E7B95E9C094F"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1E2A416-8236-43F3-8305-365F0871273D"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E23C5342-8F45-4675-9401-EBC7287D65CD"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:2.3:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AD523A5-68BB-4397-945E-C95FD0E3229A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}