CVE-2018-12464 is a critical SQL injection vulnerability affecting Micro Focus Secure Messaging Gateway versions prior to 471. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL statements, potentially creating administrative accounts and, when combined with CVE-2018-12465, achieving unauthenticated remote code execution. With a CVSS score of 9.8 (Critical) and an EPSS percentile of 0.764, this vulnerability presents a high risk due to its network-based attack vector and low complexity. While not listed on the KEV catalog, public exploit code, including a Metasploit module, is available, indicating a high potential for exploitation despite limited community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 471CPE matchmatch criteria | cpe:2.3:a:microfocus:secure_messaging_gateway:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.