Improper input validation in Micro Focus Solutions Business Manager 11.4
CVE-2018-7679
Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote code execution.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.023 (82.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 82.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.023 · newest: 0.023 · change: 0.000
Affected products
- Micro Focus Solutions Business Manager 11.4 — versions Solutions Business Manager 11.4 prior to 11.4
- Microfocus Solutions Business Manager
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2018-7679?
- CVE-2018-7679 is a critical-severity vulnerability in Micro Focus Solutions Business Manager 11.4, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2018-06-21.
- How severe is CVE-2018-7679?
- Critical severity. CVSS v3 base score is 9.8 out of 10.