FKIE_CVE-2020-11844

Vulnerability from fkie_nvd - Published: 2020-05-29 22:15 - Updated: 2026-06-17 02:50
Severity
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
References
security@opentext.comhttps://softwaresupport.softwaregrp.com/doc/KM03645628
security@opentext.comhttps://softwaresupport.softwaregrp.com/doc/KM03645629
security@opentext.comhttps://softwaresupport.softwaregrp.com/doc/KM03645630
security@opentext.comhttps://softwaresupport.softwaregrp.com/doc/KM03645631
security@opentext.comhttps://softwaresupport.softwaregrp.com/doc/KM03645636
security@opentext.comhttps://softwaresupport.softwaregrp.com/doc/KM03645642
security@opentext.comhttps://support.microfocus.com/kb/doc.php?id=7024637
af854a3a-2127-422b-91ae-364da2661108https://softwaresupport.softwaregrp.com/doc/KM03645628
af854a3a-2127-422b-91ae-364da2661108https://softwaresupport.softwaregrp.com/doc/KM03645629
af854a3a-2127-422b-91ae-364da2661108https://softwaresupport.softwaregrp.com/doc/KM03645630
af854a3a-2127-422b-91ae-364da2661108https://softwaresupport.softwaregrp.com/doc/KM03645631
af854a3a-2127-422b-91ae-364da2661108https://softwaresupport.softwaregrp.com/doc/KM03645636
af854a3a-2127-422b-91ae-364da2661108https://softwaresupport.softwaregrp.com/doc/KM03645642
af854a3a-2127-422b-91ae-364da2661108https://support.microfocus.com/kb/doc.php?id=7024637
Impacted products
Vendor Product Version
microfocus service_management_automation 2018.05
microfocus service_management_automation 2018.08
microfocus service_management_automation 2018.11
microfocus service_management_automation 2019.02
microfocus service_management_automation 2019.05
microfocus service_management_automation 2019.08
microfocus service_management_automation 2019.11
microfocus service_management_automation 2020.02
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Hybrid Cloud Management",
          "vendor": "Micro Focus",
          "versions": [
            {
              "lessThan": "2019.11",
              "status": "affected",
              "version": "2018.05",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ArcSight Investigate. versions",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.0"
            },
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            }
          ]
        },
        {
          "product": "ArcSight Transformation Hub",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            }
          ]
        },
        {
          "product": "ArcSight Interset",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.0"
            }
          ]
        },
        {
          "product": "ArcSight ESM (when ArcSight Fusion",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.1"
            }
          ]
        },
        {
          "product": "Service Management Automation (SMA)",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "status": "affected",
              "version": "2018.08"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2019.02"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2019.08"
            },
            {
              "status": "affected",
              "version": "2019.11"
            },
            {
              "status": "affected",
              "version": "2020.02"
            }
          ]
        },
        {
          "product": "Operation Bridge Suite (Containerized)",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "status": "affected",
              "version": "2018.08"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2019.02"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2019.8"
            },
            {
              "status": "affected",
              "version": "2019.11"
            }
          ]
        },
        {
          "product": "Network Operation Management",
          "vendor": "Micro Focus",
          "versions": [
            {
              "lessThanOrEqual": "2019.11",
              "status": "affected",
              "version": "2017.11",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Data Center Automation Containerized",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "status": "affected",
              "version": "2018.08"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2019.02"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2019.08"
            },
            {
              "status": "affected",
              "version": "2019.11"
            }
          ]
        },
        {
          "product": "Identity Intelligence. versions",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0"
            },
            {
              "lessThan": "unspecified",
              "status": "unaffected",
              "version": "next of 1.1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@opentext.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*",
              "matchCriteriaId": "3909E337-F1FC-45C8-A120-EEBDBFB0E4D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:*",
              "matchCriteriaId": "934D6CB3-E159-40F4-8E5B-CDDDD824CAA0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "82C0FD9D-6117-40DE-9386-7327867F9615",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CEF7C73-7A74-4CAE-B420-F1BB011CEA30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.05:*:*:*:*:*:*:*",
              "matchCriteriaId": "19C9AB03-FAC2-4150-BC35-37128DA918C8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.08:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF6D712E-A7E4-4ACD-83D9-FF173C69381C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "CBD8E09D-599D-4F8E-8221-C034BF0A70E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2020.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "65EF7382-2760-4C01-8731-D5D8DDF3A47E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de la autorizaci\u00f3n incorrecta en el componente Micro Focus Container Deployment Foundation afecta a los productos: Hybrid Cloud Management. desde la versi\u00f3n 2018.05 hasta 2019.11. - ArcSight Investigate. versiones 2.4.0, 3.0.0 y 3.1.0. - ArcSight Transformation Hub. versiones 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. versi\u00f3n 6.0.0. - ArcSight ESM (cuando se instala ArcSight Fusion 1.0). versi\u00f3n 7.2.1. - Service Management Automation (SMA). desde la versi\u00f3n 2018.05 hasta 2020.02 - Operation Bridge Suite (Containerized). desde la versi\u00f3n 2018.05 hasta 2020.02. - Network Operation Management. desde la versi\u00f3n 2017.11 hasta 2019.11. - Data Center Automation Containerized. desde la versi\u00f3n  2018.05 hasta 2019.11. La vulnerabilidad podr\u00eda ser explotada para proporcionar acceso no autorizado al Container Deployment Foundation"
    }
  ],
  "id": "CVE-2020-11844",
  "lastModified": "2026-06-17T02:50:53.927",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "security@opentext.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-05-29T22:15:10.473",
  "references": [
    {
      "source": "security@opentext.com",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645628"
    },
    {
      "source": "security@opentext.com",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645629"
    },
    {
      "source": "security@opentext.com",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645630"
    },
    {
      "source": "security@opentext.com",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645631"
    },
    {
      "source": "security@opentext.com",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645636"
    },
    {
      "source": "security@opentext.com",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645642"
    },
    {
      "source": "security@opentext.com",
      "url": "https://support.microfocus.com/kb/doc.php?id=7024637"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645628"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645629"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645630"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645631"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645636"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645642"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://support.microfocus.com/kb/doc.php?id=7024637"
    }
  ],
  "sourceIdentifier": "security@opentext.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security@opentext.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.