What is CVE-2019-3490?

CVE-2019-3490 is a medium-severity vulnerability in Microfocus Open Enterprise Server, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2019-05-02.

How severe is CVE-2019-3490?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Microfocus Open Enterprise Server

CVE-2019-3490

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and OES2018SP1. Older versions may be affected but were not tested as they are out of support.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.010 (59.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Microfocus Open_enterprise_server — versions 2015.1, 2018.0, 2018.1
Oes Netstorage Component Of Open Enterprise Server — versions OES2015SP1, OES2018, and OES2018SP1

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security@opentext.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2019-3490?: CVE-2019-3490 is a medium-severity vulnerability in Microfocus Open Enterprise Server, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2019-05-02.
How severe is CVE-2019-3490?: Medium severity. CVSS v3 base score is 6.1 out of 10.