CVE-2018-12464 CRITICAL

CVE-2018-12464: Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway

Vendor Micro Focus
Product Secure Messaging Gateway
Weakness CWE-89 · SQLi
Published June 29, 2018
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5).

Key dates

02Disclosure timeline

June 29, 2018 CVE published
September 17, 2024 Record updated