CVE-2018-12464in critical feed2 exploits
Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway
Published 8 y ago · modified 4 mo ago · JSON
Summary
A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5).
Exploit prediction (EPSS)
80.67% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
Exploits and detections
- Metasploit exploit/linux/http/microfocus_secure_messaging_gateway MicroFocus Secure Messaging Gateway Remote Code Execution · metasploit exploit, excellent rank · 2018-06-19
- EDB-45083 Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit) · webapps · 2018-07-24
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| CNA | 3.0 | 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Micro Focus Secure Messaging Gateway
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- exploit-db.com /exploits/45083/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- support.microfocus.com /kb/doc.php?id=7023132 · x_refsource_CONFIRM, x_transferred
- pentest.blog /unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-mes · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-12464
- NVD: CVE-2018-12464
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.