CVE-2018-12465: Remote Code Execution in Micro Focus Secure Messaging Gateway
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that used GWAVA product name (i.e. GWAVA 6.5).
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12465?
CVE-2018-12465 has a high severity rating due to its potential for remote code execution.
How do I fix CVE-2018-12465?
To remediate CVE-2018-12465, upgrade your Micro Focus Secure Messaging Gateway to version 471 or later.
What kind of attacks can CVE-2018-12465 facilitate?
CVE-2018-12465 allows authenticated remote attackers to execute arbitrary OS commands on the server.
Is CVE-2018-12465 exploitable without authentication?
No, CVE-2018-12465 requires an authenticated privileged user to exploit the vulnerability.
What components are affected by CVE-2018-12465?
The vulnerability affects the web administration component of Micro Focus Secure Messaging Gateway.