TI-2018-08951 Aliases CVE-2018-12465 GHSA-ch8c-p3pw-fg7f

Remote Code Execution in Micro Focus Secure Messaging Gateway

HIGH 79CWE-77Published 2018-06-29 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that used GWAVA product name (i.e. GWAVA 6.5).

Why it matters now

EPSS 0.80021 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Secure Messaging Gateway (Micro Focus): 471

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Micro Focus	Secure Messaging Gateway	before 471	471	Patch available	CNA

Secure Messaging Gateway VendorMicro Focus Affected before 471 Fixed in 471 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:microfocus:secure_messaging_gateway::::::::	before 471	Vulnerable	Micro Focus International

cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:* Versions before 471 Vulnerable ·Micro Focus International

Remediation

Fix · CNA Secure Messaging Gateway (Micro Focus) Fixed in 471

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2018-06-29
Micro Focus Secure Messaging Gateway 471
2 records Highest priority Priority HIGH 2 HIGH
Other records, highest priority first
- TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging GatewayPriority HIGH 83
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2018-12465
2026-10-03 Alias added: GHSA-ch8c-p3pw-fg7f

References

Exploit 1

45083

Other 2

TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 10.0
TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
TI-2017-10842 In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a… CVSS 3.0CRITICAL 9.8

See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences