microfocus service-management-automation CVE-2020-11844 vulnerability in Micro Focus Products
Published on May 29, 2020

Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.
Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.

NVD

Vulnerability Analysis

CVE-2020-11844 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is an AuthZ Vulnerability?

The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVE-2020-11844 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2020-11844

stack.watch emails you whenever new vulnerabilities are published in Micro Focus Service Management Automation or Micro Focus Hybrid Cloud Management. Just hit a watch button to start following.

Micro Focus Service Management Automation
 
Micro Focus Hybrid Cloud Management
 

Affected Versions

Micro Focus Hybrid Cloud Management: Micro Focus ArcSight Investigate. versions: Micro Focus ArcSight Transformation Hub: Micro Focus ArcSight Interset: Micro Focus ArcSight ESM (when ArcSight Fusion: Micro Focus Service Management Automation (SMA): Micro Focus Operation Bridge Suite (Containerized): Micro Focus Network Operation Management: Micro Focus Data Center Automation Containerized: Micro Focus Identity Intelligence. versions:

Exploit Probability

EPSS
1.03%
Percentile
77.09%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.