Skip to content
CVE Tracker
Back

CVE-2016-5765

Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection…

Medium6.5EPSS 2.2%
Published
Updated
Reserved
Assigned by
microfocus

Description

Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14.

Scores

CVSS scores of CVE-2016-5765, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0Medium6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
2.2% · top 17% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

  • Micro Focus MSS, RWeb, ZFE, RSG 1.x, 2.x, 12.x

    • affected Micro Focus MSS, RWeb, ZFE, RSG 1.x, 2.x, 12.x

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .