CVE-2017-7421 — Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features

Back Back to CVE browser

MEDIUM

Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features

Published Aug 21, 2017

6.1

MEDIUM

CVSS 3.0

EPSS 1.26%

Description

Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in Directory Server (aka Enterprise Server Administration web UI) and ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allow remote authenticated attackers to bypass protection mechanisms (CWE-693) and other security features.

Affected products

Vendor Micro Focus Product Micro Focus Enterprise Developer, Micro Focus Enterprise Server Default
n/a
- Version
  All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Micro Focus

Micro Focus Enterprise Developer, Micro Focus Enterprise Server

n/a

Version	Status	Constraints
All versions before 2.3 Update 1, 2.3 Update 1 before Hotfix 8, 2.3 Update 2 before Hotfix 9	affected	-

Remediation

No remediation recorded yet.

Metrics

1.26% 0.01259

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01259

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.26% (0.01259)	68.51th	v5 (v2026.06.15)
Aug 23, 2026	1.72% (0.01716)	75.31th	v5 (v2026.06.15)
Jul 20, 2024	0.12% (0.00116)	45.80th	v3 (v2023.03.01)
May 1, 2024	0.12% (0.00116)	44.79th	v3 (v2023.03.01)
Mar 7, 2023	0.10% (0.00101)	39.98th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Feb 4, 2022	1.05% (0.01055)	27.52th	v2 (v2022.01.01)
Feb 3, 2022	0.56% (0.00556)	13.12th	v5 (v2026.06.15)
Apr 14, 2021	0.56% (0.00556)	0.00th	v1

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017
x_refsource_MISC

Link	Providers	Tags
https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29131/enterprise-server-security-fixes-july-2017		x_refsource_MISC