Back
CVE-2017-7420
CRITICAL
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter configuration information and alter the state of the running product (CWE-275).
Published: Aug 21, 2017
Modified: Jun 17, 2026
CWE-287
CWE-287
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (7)
| Vendor | Product | Version |
|---|---|---|
| microfocus | enterprise_developer | 2.3 |
| microfocus | enterprise_developer | 2.3 |
| microfocus | enterprise_developer | 2.3 |
| microfocus | enterprise_server | * |
| microfocus | enterprise_server | 2.3 |
| microfocus | enterprise_server | 2.3 |
| microfocus | enterprise_server_monitor_and_control | - |
GitHub Security Advisory GHSA-mh7j-5vww-cqrw
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and...
References (2)
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
2.44%
Top 17% most likely to be exploited
Threat Score
39.9 / 100
Data Sources
NVD
EPSS
GitHub