CVE-2017-7433: An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authen

Q: How do I fix CVE-2017-7433?

vibe: upgrade to newer than 4.0.2. Exact commands for each OS are on this page.

Q: Is CVE-2017-7433 being exploited?

CVE-2017-7433 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2017-7433 affect?

CVE-2017-7433 affects vibe. Severity is medium (CVSS 6.5). An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. N

Q: How urgent is CVE-2017-7433?

Priority 41/100. No elevated risk signals yet.

This month

MEDIUM 6.5UPGRADE

CVE-2017-7433 is a medium-severity flaw (CVSS 6.5) affecting vibe. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication if Guest access is enabled (Guest access is disabled by default).

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.5 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	1.4% (top 28%)
CISA exploited list	No
Weakness	CWE-22
Published	2017-05-18
Last modified	2026-06-17

Publisher (CNA): OpenText · Vendor: micro focus

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2017-05-18 14:29 UTCPublished CVE record published
2026-06-17 01:24 UTCUpdated Record last modified

micro focus vibe UPGRADE

Affected: <= 4.0.2

Fixed in: newer than 4.0.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy vibe || rpm -q vibe || vibe --version

2. UPGRADE to newer than 4.0.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade vibe

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade vibe

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2017-7433?

vibe: upgrade to newer than 4.0.2. Exact commands for each OS are on this page.

Is CVE-2017-7433 being exploited?

CVE-2017-7433 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2017-7433 affect?

CVE-2017-7433 affects vibe. Severity is medium (CVSS 6.5). An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. N

How urgent is CVE-2017-7433?

Priority 41/100. No elevated risk signals yet.

Related CVEs

CVE-2020-9520 MEDIUM 5.4 UPGRADE A stored XSS vulnerability was discovered in Micro Focus Vibe, affecting all Vibe version prior to 4.0.7

References

← Back to latest CVEs