Lucene search

OpenTextCVE-2023-32265

HistoryJul 20, 2023 - 2:15 p.m.

CVE-2023-32265

2023-07-2014:15:11

OpenText

web.nvd.nist.gov

cve-2023-32265

security vulnerability

escwa

enterprise server

enterprise test server

visual cobol

cobol server

authentication

network access restriction

micro focus directory server

service account password

privilege escalation

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

28.1%

JSON

A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server.
An attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting usersâ€™ permissions in the Micro Focus Directory Server also reduce the exposure to this issue.

Given the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.

Affected configurations

Nvd

Node

microfocuscobol_serverMatch6.0-

microfocuscobol_serverMatch7.0-

microfocuscobol_serverMatch8.0-

microfocusenterprise_developerMatch6.0-

microfocusenterprise_developerMatch7.0-

microfocusenterprise_developerMatch8.0-

microfocusenterprise_serverMatch6.0-

microfocusenterprise_serverMatch7.0-

microfocusenterprise_serverMatch8.0-

microfocusenterprise_test_serverMatch6.0-

microfocusenterprise_test_serverMatch7.0-

microfocusenterprise_test_serverMatch8.0-

microfocusvisual_cobolMatch6.0-

microfocusvisual_cobolMatch7.0-

microfocusvisual_cobolMatch8.0-

VendorProductVersionCPE
microfocuscobol_server6.0cpe:2.3:a:microfocus:cobol_server:6.0:-:*:*:*:*:*:*
microfocuscobol_server7.0cpe:2.3:a:microfocus:cobol_server:7.0:-:*:*:*:*:*:*
microfocuscobol_server8.0cpe:2.3:a:microfocus:cobol_server:8.0:-:*:*:*:*:*:*
microfocusenterprise_developer6.0cpe:2.3:a:microfocus:enterprise_developer:6.0:-:*:*:*:*:*:*
microfocusenterprise_developer7.0cpe:2.3:a:microfocus:enterprise_developer:7.0:-:*:*:*:*:*:*
microfocusenterprise_developer8.0cpe:2.3:a:microfocus:enterprise_developer:8.0:-:*:*:*:*:*:*
microfocusenterprise_server6.0cpe:2.3:a:microfocus:enterprise_server:6.0:-:*:*:*:*:*:*
microfocusenterprise_server7.0cpe:2.3:a:microfocus:enterprise_server:7.0:-:*:*:*:*:*:*
microfocusenterprise_server8.0cpe:2.3:a:microfocus:enterprise_server:8.0:-:*:*:*:*:*:*
microfocusenterprise_test_server6.0cpe:2.3:a:microfocus:enterprise_test_server:6.0:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
microfocus	cobol_server	6.0	cpe:2.3:a:microfocus:cobol_server:6.0:-::::::
microfocus	cobol_server	7.0	cpe:2.3:a:microfocus:cobol_server:7.0:-::::::
microfocus	cobol_server	8.0	cpe:2.3:a:microfocus:cobol_server:8.0:-::::::
microfocus	enterprise_developer	6.0	cpe:2.3:a:microfocus:enterprise_developer:6.0:-::::::
microfocus	enterprise_developer	7.0	cpe:2.3:a:microfocus:enterprise_developer:7.0:-::::::
microfocus	enterprise_developer	8.0	cpe:2.3:a:microfocus:enterprise_developer:8.0:-::::::
microfocus	enterprise_server	6.0	cpe:2.3:a:microfocus:enterprise_server:6.0:-::::::
microfocus	enterprise_server	7.0	cpe:2.3:a:microfocus:enterprise_server:7.0:-::::::
microfocus	enterprise_server	8.0	cpe:2.3:a:microfocus:enterprise_server:8.0:-::::::
microfocus	enterprise_test_server	6.0	cpe:2.3:a:microfocus:enterprise_test_server:6.0:-::::::

Rows per page:

1-10 of 151

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Enterprise Server",
    "vendor": "Micro Focus",
    "versions": [
      {
        "lessThanOrEqual": "6.0 update 24",
        "status": "affected",
        "version": "6.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.0 update 17",
        "status": "affected",
        "version": "7.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.0 update 6",
        "status": "affected",
        "version": "8.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Enterprise Test Server",
    "vendor": "Micro Focus",
    "versions": [
      {
        "lessThanOrEqual": "6.0 update 24",
        "status": "affected",
        "version": "6.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.0 update 17",
        "status": "affected",
        "version": "7.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.0 update 6",
        "status": "affected",
        "version": "8.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Enterprise Developer",
    "vendor": "Micro Focus",
    "versions": [
      {
        "lessThanOrEqual": "6.0 update 24",
        "status": "affected",
        "version": "6.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.0 update 17",
        "status": "affected",
        "version": "7.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.0 update 6",
        "status": "affected",
        "version": "8.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Visual COBOL",
    "vendor": "Micro Focus",
    "versions": [
      {
        "lessThanOrEqual": "6.0 update 24",
        "status": "affected",
        "version": "6.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.0 update 17",
        "status": "affected",
        "version": "7.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.0 update 6",
        "status": "affected",
        "version": "8.0 ",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "COBOL Server",
    "vendor": "Micro Focus",
    "versions": [
      {
        "lessThanOrEqual": "6.0 update 24",
        "status": "affected",
        "version": "6.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.0 update 17",
        "status": "affected",
        "version": "7.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "8.0 update 6",
        "status": "affected",
        "version": "8.0 ",
        "versionType": "semver"
      }
    ]
  }
]

References

portal.microfocus.com/s/article/KM000019323?language=en_US

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

28.1%

JSON

Related for CVE-2023-32265