Arbitrary file upload in Micro Focus Groupwise
CVE-2018-12468
A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution.
Vulnerability class: Unrestricted File Upload
EPSS: 0.022 (80.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Micro Focus Groupwise — versions 2018
- Microfocus Groupwise
Weakness classification (CWE)
References
- security@opentext.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2018-12468?
- CVE-2018-12468 is a critical-severity vulnerability in Micro Focus Groupwise, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.1/10. Published 2018-08-01.
- How severe is CVE-2018-12468?
- Critical severity. CVSS v3 base score is 9.1 out of 10.