Read the docs
TI-2019-08723 Aliases CVE-2019-11654GHSA-rvwr-5mx9-7qqq

A path traversal vulnerability has been identified in Verastream Host Integrator

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.

Why it matters now

EPSS 0.0262 85th percentileScored 2026-11-07
Fix Fixed Verastream Host Integrator (Micro Focus): 7.7 SP2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Micro FocusVerastream Host Integratorbefore 7.7 SP27.7 SP2Patch availableCNA
  • Verastream Host Integrator VendorMicro Focus Affected before 7.7 SP2 Fixed in 7.7 SP2 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:microfocus:verastream_host_integrator:7.5:-:*:*:*:*:*:*7.5VulnerableMicro Focus International
cpe:2.3:a:microfocus:verastream_host_integrator:7.5:sp1:*:*:*:*:*:*7.5 sp1VulnerableMicro Focus International
cpe:2.3:a:microfocus:verastream_host_integrator:7.6:-:*:*:*:*:*:*7.6VulnerableMicro Focus International
cpe:2.3:a:microfocus:verastream_host_integrator:7.6:sp1:*:*:*:*:*:*7.6 sp1VulnerableMicro Focus International
cpe:2.3:a:microfocus:verastream_host_integrator:7.7:-:*:*:*:*:*:*7.7VulnerableMicro Focus International
cpe:2.3:a:microfocus:verastream_host_integrator:7.7:sp1:*:*:*:*:*:*7.7 sp1VulnerableMicro Focus International
cpe:2.3:a:microfocus:verastream_host_integrator:7.7:sp1_update_1:*:*:*:*:*:*7.7 sp1_update_1VulnerableMicro Focus International
cpe:2.3:a:microfocus:verastream_host_integrator:7.7:sp1_update_2:*:*:*:*:*:*7.7 sp1_update_2VulnerableMicro Focus International
cpe:2.3:a:microfocus:verastream_host_integrator:7.7:sp2:*:*:*:*:*:*7.7 sp2VulnerableMicro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.5:-:*:*:*:*:*:* Versions 7.5 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.5:sp1:*:*:*:*:*:* Versions 7.5 sp1 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.6:-:*:*:*:*:*:* Versions 7.6 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.6:sp1:*:*:*:*:*:* Versions 7.6 sp1 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.7:-:*:*:*:*:*:* Versions 7.7 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.7:sp1:*:*:*:*:*:* Versions 7.7 sp1 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.7:sp1_update_1:*:*:*:*:*:* Versions 7.7 sp1_update_1 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.7:sp1_update_2:*:*:*:*:*:* Versions 7.7 sp1_update_2 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:verastream_host_integrator:7.7:sp2:*:*:*:*:*:* Versions 7.7 sp2 Vulnerable ·Micro Focus International

Remediation

  • Fix · CNA Verastream Host Integrator (Micro Focus) Fixed in 7.7 SP2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-11654
  2. 2026-10-03 Alias added: GHSA-rvwr-5mx9-7qqq

References

Other 1

  • TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
  • TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 10.0
  • TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
  • TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 9.1
  • TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences