« Volver al listado

CVE-2020-9524

Estado: ModificadaMedia (5.4)—

Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microfocus — Enterprise DeveloperMicrofocus — Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9524",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Enterprise Server and Enterprise developer.",
          "versions": [
            {
              "status": "affected",
              "version": "All versions  prior to version 5.0 Patch Update 8."
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-05-18T14:15:12.217",
  "references": [
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03640252",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03640252",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo Cross Site scripting en Micro Focus Enterprise Server y el desarrollador Enterprise, afecta a todas las versiones anteriores a 5.0 Patch Update 8. La vulnerabilidad podría permitir a un atacante desencadenar acciones administrativas cuando un administrador visualizara datos maliciosos dejados por el atacante (XSS almacenado) o siguiera un enlace malicioso (XSS reflejado)."
    }
  ],
  "lastModified": "2026-06-17T03:28:06.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C73BDBE-2719-4020-B953-1580BB78CB0A"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7620CD64-03C0-44C3-BFD6-82C5CE5835AC"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8C8BC9D-0755-48BB-8CDD-B906C1197981"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC2BBA40-5BD9-4EE0-96A0-F1AC2BE02245"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "658DE765-305D-43BC-B1F6-290B6C203CF9"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87B914AA-7BAE-47DF-A74D-27D9925A08CE"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D4B2B00-3247-45C6-B0A1-8D12ADF6D5EC"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_developer:5.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1743FFA-D530-4FEA-A692-221312123E46"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "600A95A6-A1F6-45F1-8856-FB1968E084ED"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6784996D-C065-49FF-8474-B3BEF0F3DA9D"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF442860-F76E-47AC-BA83-DD9B6317E52A"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69104963-85AF-4B27-909E-103F8083D048"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01EDE33A-184F-44E4-8487-0D3DD875E255"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E51F296-95D1-4E53-BE4E-58681763E10A"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76C75510-91FD-426B-9AE8-487E956236AF"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:enterprise_server:5.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FF366C0-1C8C-4332-ACA6-5EF2793E9341"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}