CVE-2018-12469

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-12 · updated 2026-06-17
Weakness: CWE-476

Description

Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer dereference (CWE-476) and subsequent denial of service due to process termination.

Affected products

Micro Focus Enterprise Developer: through 2.3; 2.3-update1, 2.3-update2, 3.0, 4.0, 4.0-update1
Micro Focus Enterprise Server: through 2.3; 2.3-update1, 2.3-update2, 3.0, 4.0, 4.0-update1

References

https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018
https://community.microfocus.com/microfocus/mainframe_solutions/enterprise_server/w/knowledge_base/29624/enterprise-server-security-fix-october-2018

Get alerted when CVE-2018-12469 or the next vulnerability affects your stack