Vulnerability Details : CVE-2016-5765
Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14.
Vulnerability category: Directory traversalInformation leak
Products affected by CVE-2016-5765
- cpe:2.3:a:microfocus:reflection_zfe:2.0.1.18:*:*:*:*:*:*:*
- cpe:2.3:a:microfocus:reflection_zfe:2.0.0.52:*:*:*:*:*:*:*
- cpe:2.3:a:microfocus:reflection_zfe:1.4.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:microfocus:reflection_security_gateway:12.1:*:*:*:*:*:*:*
- cpe:2.3:a:microfocus:reflection_for_the_web:12.1:*:*:*:*:*:*:*
- cpe:2.3:a:microfocus:reflection_for_the_web:12.2:*:*:*:*:*:*:*
- cpe:2.3:a:microfocus:reflection_for_the_web:12.3:*:*:*:*:*:*:*
- cpe:2.3:a:microfocus:host_access_management_and_security_server:12.2:*:*:*:*:*:*:*
- cpe:2.3:a:microfocus:host_access_management_and_security_server:12.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-5765
18.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-5765
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2016-5765
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-5765
-
http://www.securityfocus.com/bid/94579
Multiple Micro Focus Products CVE-2016-5765 Directory Traversal Vulnerability
-
http://www.zerodayinitiative.com/advisories/ZDI-16-618
ZDI-16-618 | Zero Day Initiative
-
http://support.attachmate.com/techdocs/1704.html
Security UpdatesPatch;Vendor Advisory
Jump to