CVE-2018-12465

CriticalPublished

Remote Code Execution in Micro Focus Secure Messaging Gateway

Published: Jun 29, 2018
Updated: Sep 16, 2024
Assigning CNA: microfocus
Evidence observed: Jul 24, 2018

Primary CVSS

9.1/ 10Critical

nvd · CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS probability estimate

80.0%

High · next 30 days

Percentile: 99.6%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that used GWAVA product name (i.e. GWAVA 6.5).

Sources

Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit)Exploit
Mehmet Ince · php · Jul 24, 2018

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.