NULL pointer dereference in Micro Focus Enterprise Developer, Server
CVE-2018-12469
Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.011 (63.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 63.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Micro Focus Enterprise Developer, Server — versions All versions before 3.0 Patch Update 12, 4.0 Patch Update 2, 5.0
- Microfocus Enterprise Developer — versions 2.3, 3.0, 4.0
- Microfocus Enterprise Server — versions 2.3, 3.0, 4.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2018-12469?
- CVE-2018-12469 is a high-severity vulnerability in Micro Focus Enterprise Developer, Server, classified under NULL Pointer Dereference. CVSS score: 7.5/10. Published 2018-10-12.
- How severe is CVE-2018-12469?
- High severity. CVSS v3 base score is 7.5 out of 10.