CVE-2018-18591 - Vulnerability Details - OpenCVE

A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microfocus	Service Manager

Configuration 1 [-]

OR	cpe:2.3:a:microfocus:service_manager:9.30:::::::*
	cpe:2.3:a:microfocus:service_manager:9.31:::::::*
	cpe:2.3:a:microfocus:service_manager:9.32:::::::*
	cpe:2.3:a:microfocus:service_manager:9.33:::::::*
	cpe:2.3:a:microfocus:service_manager:9.34:::::::*
	cpe:2.3:a:microfocus:service_manager:9.35:::::::*
	cpe:2.3:a:microfocus:service_manager:9.40:::::::*
	cpe:2.3:a:microfocus:service_manager:9.41:::::::*
	cpe:2.3:a:microfocus:service_manager:9.50:::::::*
	cpe:2.3:a:microfocus:service_manager:9.51:::::::*

No data.

References

Link	Providers
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286176

History

No history.

MITRE

Status: PUBLISHED

Assigner: microfocus

Published: 2018-11-13T13:00:00Z

Updated: 2024-09-17T01:56:18.568Z

Reserved: 2018-10-23T00:00:00

Link: CVE-2018-18591

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-11-13T13:29:00.183

Modified: 2024-11-21T03:56:13.143

Link: CVE-2018-18591

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Micro Focus Service Manager", "vendor": "Micro Focus", "versions": [{"status": "affected", "version": "9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51"}]}], "datePublic": "2018-11-12T00:00:00", "descriptions": [{"lang": "en", "value": "A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data."}], "exploits": [{"lang": "en", "value": "Unauthorized Disclosure of Data"}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Unauthorized Disclosure of Data", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-01-06T16:15:30", "orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "microfocus"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286176"}], "source": {"discovery": "UNKNOWN"}, "title": "MFSBGN03823 rev.1 - Micro Focus Service Manager, unauthorized disclosure of data", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@microfocus.com", "DATE_PUBLIC": "2018-11-12T17:00:00.000Z", "ID": "CVE-2018-18591", "STATE": "PUBLIC", "TITLE": "MFSBGN03823 rev.1 - Micro Focus Service Manager, unauthorized disclosure of data"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Micro Focus Service Manager", "version": {"version_data": [{"version_value": "9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51"}]}}]}, "vendor_name": "Micro Focus"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data."}]}, "exploit": [{"lang": "en", "value": "Unauthorized Disclosure of Data"}], "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Unauthorized Disclosure of Data"}]}]}, "references": {"reference_data": [{"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286176", "refsource": "CONFIRM", "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286176"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T11:16:00.042Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286176"}]}]}, "cveMetadata": {"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "assignerShortName": "microfocus", "cveId": "CVE-2018-18591", "datePublished": "2018-11-13T13:00:00Z", "dateReserved": "2018-10-23T00:00:00", "dateUpdated": "2024-09-17T01:56:18.568Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microfocus:service_manager:9.30:*:*:*:*:*:*:*", "matchCriteriaId": "1D57D0FD-8C39-4FBE-9FFF-CA64AB46EB9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.31:*:*:*:*:*:*:*", "matchCriteriaId": "CAA92971-1EDA-4DE5-B39F-F47E48CA18A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.32:*:*:*:*:*:*:*", "matchCriteriaId": "9946A3FE-95BC-4956-A30F-7342735544C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.33:*:*:*:*:*:*:*", "matchCriteriaId": "59CBE599-6A78-46D0-B849-2C4D559765FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.34:*:*:*:*:*:*:*", "matchCriteriaId": "27319CF5-AB47-4AC6-83B7-3D54E614D4F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.35:*:*:*:*:*:*:*", "matchCriteriaId": "BB17FF7C-BED0-4F75-8222-1491C5DB74A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.40:*:*:*:*:*:*:*", "matchCriteriaId": "605746BD-70F7-4F35-ABB9-2A3A3475254C", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.41:*:*:*:*:*:*:*", "matchCriteriaId": "6B647A2C-46B2-4BE3-9361-C7C276404D77", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.50:*:*:*:*:*:*:*", "matchCriteriaId": "06C07728-DD28-4DA1-8BB4-0C8580F341A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:service_manager:9.51:*:*:*:*:*:*:*", "matchCriteriaId": "FF34890E-CF4B-47A5-A051-0E4253E943F3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data."}, {"lang": "es", "value": "Se ha identificado una potencial divulgaci\u00f3n de datos en Micro Focus Service Manager en versiones 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50 y 9.51. La vulnerabilidad podr\u00eda ser explotada para divulgar datos de forma no autorizada."}], "id": "CVE-2018-18591", "lastModified": "2024-11-21T03:56:13.143", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "security@opentext.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-11-13T13:29:00.183", "references": [{"source": "security@opentext.com", "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286176"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286176"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}