« Volver al listado

CVE-2020-11844

Estado: ModificadaCrítica (9.8)—

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized).

Leer descripción completaMostrar menos

Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microfocus — Service Management Automation

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-11844",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@opentext.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "Micro Focus",
          "product": "Hybrid Cloud Management",
          "versions": [
            {
              "status": "affected",
              "version": "2018.05",
              "lessThan": "2019.11",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "ArcSight Investigate. versions",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.0"
            },
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "ArcSight Transformation Hub",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "ArcSight Interset",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.0"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "ArcSight ESM (when ArcSight Fusion",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.1"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "Service Management Automation (SMA)",
          "versions": [
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "status": "affected",
              "version": "2018.08"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2019.02"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2019.08"
            },
            {
              "status": "affected",
              "version": "2019.11"
            },
            {
              "status": "affected",
              "version": "2020.02"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "Operation Bridge Suite (Containerized)",
          "versions": [
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "status": "affected",
              "version": "2018.08"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2019.02"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2019.8"
            },
            {
              "status": "affected",
              "version": "2019.11"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "Network Operation Management",
          "versions": [
            {
              "status": "affected",
              "version": "2017.11",
              "versionType": "custom",
              "lessThanOrEqual": "2019.11"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "Data Center Automation Containerized",
          "versions": [
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "status": "affected",
              "version": "2018.08"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2019.02"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2019.08"
            },
            {
              "status": "affected",
              "version": "2019.11"
            }
          ]
        },
        {
          "vendor": "Micro Focus",
          "product": "Identity Intelligence. versions",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0"
            },
            {
              "status": "unaffected",
              "version": "next of 1.1.1",
              "lessThan": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-05-29T22:15:10.473",
  "references": [
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645628",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645629",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645630",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645631",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645636",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645642",
      "source": "security@opentext.com"
    },
    {
      "url": "https://support.microfocus.com/kb/doc.php?id=7024637",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645628",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645629",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645630",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645631",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645636",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03645642",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.microfocus.com/kb/doc.php?id=7024637",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@opentext.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de la autorización incorrecta en el componente Micro Focus Container Deployment Foundation afecta a los productos: Hybrid Cloud Management. desde la versión 2018.05 hasta 2019.11. - ArcSight Investigate. versiones 2.4.0, 3.0.0 y 3.1.0. - ArcSight Transformation Hub. versiones 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. versión 6.0.0. - ArcSight ESM (cuando se instala ArcSight Fusion 1.0). versión 7.2.1. - Service Management Automation (SMA). desde la versión 2018.05 hasta 2020.02 - Operation Bridge Suite (Containerized). desde la versión 2018.05 hasta 2020.02. - Network Operation Management. desde la versión 2017.11 hasta 2019.11. - Data Center Automation Containerized. desde la versión  2018.05 hasta 2019.11. La vulnerabilidad podría ser explotada para proporcionar acceso no autorizado al Container Deployment Foundation"
    }
  ],
  "lastModified": "2026-06-17T02:50:53.927",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3909E337-F1FC-45C8-A120-EEBDBFB0E4D0"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "934D6CB3-E159-40F4-8E5B-CDDDD824CAA0"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82C0FD9D-6117-40DE-9386-7327867F9615"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8CEF7C73-7A74-4CAE-B420-F1BB011CEA30"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19C9AB03-FAC2-4150-BC35-37128DA918C8"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.08:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF6D712E-A7E4-4ACD-83D9-FF173C69381C"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBD8E09D-599D-4F8E-8221-C034BF0A70E6"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:service_management_automation:2020.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65EF7382-2760-4C01-8731-D5D8DDF3A47E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}