CVE-2017-5187 — A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests

Back Back to CVE browser

HIGH

A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests

Published Aug 21, 2017

8.8

HIGH

CVSS 3.0

EPSS 0.75%

Description

A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to view and alter (CWE-275) configuration information and inject OS commands (CWE-78) via forged requests.

Affected products

Vendor Micro Focus Product Micro Focus Enterprise Developer, Micro Focus Enterprise Server Default
n/a
- Version
  2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Micro Focus

Micro Focus Enterprise Developer, Micro Focus Enterprise Server

n/a

Version	Status	Constraints
2.3 before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9	affected	-

Remediation

No remediation recorded yet.

Metrics

0.75% 0.00751

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00751

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.75% (0.00751)	53.31th	v5 (v2026.06.15)
Sep 20, 2026	0.75% (0.00751)	53.48th	v5 (v2026.06.15)
Jul 20, 2024	0.11% (0.00108)	44.17th	v3 (v2023.03.01)
May 1, 2024	0.11% (0.00108)	43.04th	v3 (v2023.03.01)
Mar 7, 2023	0.10% (0.00098)	39.18th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Feb 4, 2022	1.05% (0.01055)	27.52th	v2 (v2022.01.01)
Feb 3, 2022	0.56% (0.00556)	13.12th	v5 (v2026.06.15)
Apr 14, 2021	0.56% (0.00556)	0.00th	v1

Weaknesses (1)

CWE-352

CSRF

References (1)

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017
x_refsource_MISC

Link	Providers	Tags
https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017		x_refsource_MISC

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microfocus

Published Aug 21, 2017

Updated Sep 16, 2024

Reserved Jan 6, 2017

Link CVE-2017-5187

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-5187

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-5187