Medium severity · published Dec 16, 2022
CVE-2022-38756
A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Groupwise · Microfocus
before 18.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38756
packetstormsecurity.com
http://packetstormsecurity.com/files/170768/Micro-Focus-GroupWise-Session-ID-Disclosure.html
seclists.org
http://seclists.org/fulldisclosure/2023/Jan/28
portal.microfocus.com
https://portal.microfocus.com/s/article/KM000012374?language=en_US
packetstorm.news
https://packetstorm.news/files/id/170768
seclists.org
https://seclists.org/fulldisclosure/2023/Jan/28
More from Groupwise
7.2
CVE-2018-12468
Arbitrary File Upload in GroupWise Administration Console