Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.01028.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Micro Focus Hybrid Cloud Management affected
Version Status Constraints
2018.05 affected < 2019.11
Micro Focus ArcSight Investigate. versions affected
Version Status Constraints
2.4.0 affected —
3.0.0 affected —
3.1.0 affected —
Micro Focus ArcSight Transformation Hub affected
Version Status Constraints
3.0.0 affected —
3.1.0 affected —
3.2.0 affected —
Micro Focus ArcSight Interset affected
Version Status Constraints
6.0.0 affected —
Micro Focus ArcSight ESM (when ArcSight Fusion affected
Version Status Constraints
7.2.1 affected —
Micro Focus Service Management Automation (SMA) affected
Version Status Constraints
2018.05 affected —
2018.08 affected —
2018.11 affected —
2019.02 affected —
2019.05 affected —
2019.08 affected —
2019.11 affected —
2020.02 affected —
Micro Focus Operation Bridge Suite (Containerized) affected
Version Status Constraints
2018.05 affected —
2018.08 affected —
2018.11 affected —
2019.02 affected —
2019.05 affected —
2019.8 affected —
2019.11 affected —
Micro Focus Network Operation Management affected
Version Status Constraints
2017.11 affected ≤ 2019.11
Micro Focus Data Center Automation Containerized affected
Version Status Constraints
2018.05 affected —
2018.08 affected —
2018.11 affected —
2019.02 affected —
2019.05 affected —
2019.08 affected —
2019.11 affected —
Micro Focus Identity Intelligence. versions affected
Version Status Constraints
1.1.0 affected —
next of 1.1.1 unaffected < unspecified

Configuration 1 [-]

OR cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*
cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:*
cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:*
cpe:2.3:a:microfocus:service_management_automation:2019.02:*:*:*:*:*:*:*
cpe:2.3:a:microfocus:service_management_automation:2019.05:*:*:*:*:*:*:*
cpe:2.3:a:microfocus:service_management_automation:2019.08:*:*:*:*:*:*:*
cpe:2.3:a:microfocus:service_management_automation:2019.11:*:*:*:*:*:*:*
cpe:2.3:a:microfocus:service_management_automation:2020.02:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Microfocus Subscribe
Service Management Automation Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2020-4184 Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
Fixes

Solution

For Data Center Automation Containerized https://softwaresupport.softwaregrp.com/doc/KM03645628 For Network Operation Management https://softwaresupport.softwaregrp.com/doc/KM03645629 For Operation Bridge Suite https://softwaresupport.softwaregrp.com/doc/KM03645630 For SMA https://softwaresupport.softwaregrp.com/doc/KM03645631 For ArcSight apps https://softwaresupport.softwaregrp.com/doc/KM03645642 For Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03645636 For Identity Intelligence https://support.microfocus.com/kb/doc.php?id=7024637" } ] }

Workaround

No workaround given by the vendor.

References
Link Providers
https://softwaresupport.softwaregrp.com/doc/KM03645628 cve-icon cve-icon
https://softwaresupport.softwaregrp.com/doc/KM03645629 cve-icon cve-icon
https://softwaresupport.softwaregrp.com/doc/KM03645630 cve-icon cve-icon
https://softwaresupport.softwaregrp.com/doc/KM03645631 cve-icon cve-icon
https://softwaresupport.softwaregrp.com/doc/KM03645636 cve-icon cve-icon
https://softwaresupport.softwaregrp.com/doc/KM03645642 cve-icon cve-icon
https://support.microfocus.com/kb/doc.php?id=7024637 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: microfocus

Published:

Updated: 2024-08-04T11:42:00.664Z

Reserved: 2020-04-16T00:00:00.000Z

Link: CVE-2020-11844

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-05-29T22:15:10.473

Modified: 2024-11-21T04:58:44.540

Link: CVE-2020-11844

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses