Log in Start free

Vulnerability · Published May 29, 2020 · Assigned by microfocus

CVE-2020-11844Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.

Critical 10.0

In plain English

A critical-severity incorrect authorization in ArcSight ESM (when ArcSight Fusion from Micro Focus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.1%top 18.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.

Affected products (as reported)

VendorProductVersions
Micro Focus Hybrid Cloud Management 2018.05 – before 2019.11
Micro Focus ArcSight Investigate. versions 2.4.03.0.03.1.0
Micro Focus ArcSight Transformation Hub 3.0.03.1.03.2.0
Micro Focus ArcSight Interset 6.0.0
Micro Focus ArcSight ESM (when ArcSight Fusion 7.2.1
Micro Focus Service Management Automation (SMA) 2018.052018.082018.112019.022019.052019.082019.112020.02
Micro Focus Operation Bridge Suite (Containerized) 2018.052018.082018.112019.022019.052019.82019.11
Micro Focus Network Operation Management 2017.11 – through 2019.11
Micro Focus Data Center Automation Containerized 2018.052018.082018.112019.022019.052019.082019.11
Micro Focus Identity Intelligence. versions 1.1.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References