TI-2018-08950 Aliases CVE-2018-12464 GHSA-qx98-cwxc-vrv6

Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway

HIGH 83CWE-89Published 2018-06-29 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5).

Why it matters now

EPSS 0.80672 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Secure Messaging Gateway (Micro Focus): 471

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Micro Focus	Secure Messaging Gateway	before 471	471	Patch available	CNA

Secure Messaging Gateway VendorMicro Focus Affected before 471 Fixed in 471 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:microfocus:secure_messaging_gateway::::::::	before 471	Vulnerable	Micro Focus International

cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:* Versions before 471 Vulnerable ·Micro Focus International

Remediation

Fix · CNA Secure Messaging Gateway (Micro Focus) Fixed in 471

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2018-06-29
Micro Focus Secure Messaging Gateway 471
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging GatewayPriority HIGH 79
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2018-12464
2026-10-03 Alias added: GHSA-qx98-cwxc-vrv6

References

Exploit 1

45083

Other 2

TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 9.1
TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
TI-2017-10842 In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a… CVSS 3.0CRITICAL 9.8

See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences