CVE-2020-11844

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
Micro FocusHybrid Cloud Management>= 2018.05, < 2019.11
Micro FocusArcSight Investigate. versions2.4.0; 3.0.0; 3.1.0
Micro FocusArcSight Transformation Hub3.0.0; 3.1.0; 3.2.0
Micro FocusArcSight Interset6.0.0
Micro FocusArcSight ESM (when ArcSight Fusion7.2.1
Micro FocusService Management Automation (SMA)2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.08; 2019.11; 2020.02
Micro FocusOperation Bridge Suite (Containerized)2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.8; 2019.11
Micro FocusNetwork Operation Management>= 2017.11, <= 2019.11
Micro FocusData Center Automation Containerized2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.08; 2019.11
Micro FocusIdentity Intelligence. versions1.1.0

References

Timeline

Published
May 29, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-118456.1Cross Site Scripting vulnerability in Micro Focus Service Manager product. Affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The CVE-2020-118467.5A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set thatCVE-2020-118477.8SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects PrCVE-2020-118487.5Denial of service vulnerability on Micro Focus ArcSight Management Center. Affecting all versions prior to version 2.9.5. The vulnerability CVE-2020-118499.8Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager. Affecting versions prior to 4.7.3 and 4.8.1CVE-2020-11857.8An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker wCVE-2020-118506.1Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Cross-Site Scripting (XSS). This issue affects Self SCVE-2020-118519.8Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability couldCVE-2020-118528.8DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to CVE-2020-118538.8Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 201CVE-2020-118549.8Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) CVE-2020-118557.8An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could