Improper input validation in Microsoft Forefront Unified Access Gateway - CVE-2018-12571
Published: July 3, 2018 / Updated: July 6, 2018
Vulnerability identifier: #VU13594
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12571
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify system information on the target system.
The vulnerability exists due to an error when processing malicious input. A remote attacker can submit a specially crafted 'orig_url' parameter value that includes a comma-separated list of URLs and cause the target server to initiate DNS queries for the hosts specified in the URLs.
Affected software
Microsoft Forefront Unified Access Gateway
How to mitigate CVE-2018-12571
The vendor does not plan to issue a fix as part of a security update.