CVE-2017-7420 Auth bypass in Micro Focus Enterprise Developer, Micro Focus Enterprise Server

Critical 9.8 Published 21 Aug 2017 Updated 16 Sep 2024

Remote unauthenticated attackers can bypass authentication to view and alter configuration information and the state of the running product.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-7420?

CVE-2017-7420 is a critical authentication bypass vulnerability in Micro Focus Enterprise Developer, Micro Focus Enterprise Server, published on 21 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275).

Weakness: CWE-287

Which versions are affected by CVE-2017-7420?

It affects 3 products.

Products include Microfocus Enterprise Developer, Microfocus Enterprise Server, Microfocus Enterprise Server Monitor and Control.

How do I fix CVE-2017-7420?

No fix has been published for CVE-2017-7420 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-7420 being exploited?

There is no known exploitation of CVE-2017-7420 in the wild and no public exploit code.

Sources

Also known as GHSA-mh7j-5vww-cqrw.