CVE-2018-6497: micro focus cms server Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2018-6497 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in micro focus cms server. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.5% of scored vulnerabilities.
Timeline
- 15-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31, 10.32, 10.33, 10.33 CUP2, 11.0 and CMS Server version 2018.05 BACKGROUND which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST7.5HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected systems
Micro focus2 products
- cms server2018.05 BACKGROUND
- universal cmdb serverDDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31, 10.32, 10.33, 10.33 CUP2, 11.0
Microfocus2 products
- cms_server2018.05
- universal_cmbd_server≥ 10.20, ≤ 11.0
2 vendors · 4 products
References
2 links- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03180069X Refsource CONFIRM