CVE-2018-19644 Solutions Business Manager (SBM) reflected cross site script issue in version prior to 11.5
Attackers can execute arbitrary scripts in user browsers via reflected XSS in Micro Focus Solutions Business Manager, potentially leading to session hijacking.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-19644?
CVE-2018-19644 is a medium-severity cross-site scripting vulnerability in Micro Focus Solutions Business Manager (SBM), published on 27 Mar 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.
Weakness: CWE-79
Which versions are affected by CVE-2018-19644?
It affects 1 product.
Products include Microfocus Solutions Business Manager.
How do I fix CVE-2018-19644?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-19644 being exploited?
There is no known exploitation of CVE-2018-19644 in the wild and no public exploit code.
Other vulnerabilities in Micro Focus Solutions Business Manager (SBM)
- CVE-2018-19645 Solutions Business Manager (SBM) Authentication Bypass Issue in Version prior to 11.5
- CVE-2018-7679 File upload in Solutions Business Manager 11.4
- CVE-2018-7683 Information disclosure in Solutions Business Manager 11.4
- CVE-2019-18945 privilege escalation
- CVE-2018-7682 Other in Solutions Business Manager 11.4
Sources
Also known as GHSA-cf75-j5m4-47j5.