CVE-2023-32265

What it is

A potential security vulnerability has been identified in the Enterprise Server Common Web Administration (ESCWA) component used in Enterprise Server, Enterprise Test Server, Enterprise Developer, Visual COBOL, and COBOL Server. An attacker would need to be authenticated into ESCWA to attempt to exploit this vulnerability. As described in the hardening guide in the product documentation, other mitigations including restricting network access to ESCWA and restricting users’ permissions in the Micro Focus Directory Server also reduce the exposure to this issue. Given the right conditions this vulnerability could be exploited to expose a service account password. The account corresponding to the exposed credentials usually has limited privileges and, in many cases would only be useful for extracting details of other user accounts and similar information.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2023-07-20 14:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 05:58 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.5% in the next 30 days (EPSS).
• Severity: 7.1 HIGH (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2023-07-20 14:15 UTC

Last modified

2026-06-17 05:58 UTC

Exploit probability

0.5% · EPSS, next 30 days

Record status

Modified

Affected

• Microfocus Cobol Server 6.0
• Microfocus Cobol Server 7.0
• Microfocus Cobol Server 8.0
• Microfocus Enterprise Developer 6.0
• Microfocus Enterprise Developer 7.0
• Microfocus Enterprise Developer 8.0
• Microfocus Enterprise Server 6.0
• Microfocus Enterprise Server 7.0

Attack profile CVSS 3.1 · 7.1

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2023-32265.md and follow it. Check whether this project is affected by CVE-2023-32265. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge