Read the docs
TI-2022-18266 Aliases CVE-2022-38756GHSA-664m-3r2m-mxpx

CVE-2022-38756 vulnerability in GW Web prior to 18.4.2

Priority MEDIUM 53CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00885 59th percentileScored 2026-11-07
Fix Fixed Micro Focus GroupWise Web (Micro Focus): 18.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Micro FocusMicro Focus GroupWise Webbefore 18.4.218.4.2Patch availableCNA
  • Micro Focus GroupWise Web VendorMicro Focus Affected before 18.4.2 Fixed in 18.4.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microfocus:groupwise:*:*:*:*:*:*:*:*before 18.4.2VulnerableMicro Focus International

Remediation

  • Fix · CNA Micro Focus GroupWise Web (Micro Focus) Fixed in 18.4.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38756
  2. 2026-10-03 Alias added: GHSA-664m-3r2m-mxpx

References

Other 3

  • TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
  • TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 10.0
  • TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
  • TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 9.1
  • TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences