CVE-2020-11844

CRITICAL

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.

Published: May 29, 2020 Modified: Jun 17, 2026

CWE-863 CWE-863

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: CHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products (8)

Vendor	Product	Version
microfocus	service_management_automation	2018.05
microfocus	service_management_automation	2018.08
microfocus	service_management_automation	2018.11
microfocus	service_management_automation	2019.02
microfocus	service_management_automation	2019.05
microfocus	service_management_automation	2019.08
microfocus	service_management_automation	2019.11
microfocus	service_management_automation	2020.02

GitHub Security Advisory GHSA-99j9-w4cp-4529

There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation ...

References (14)

Risk Scores

CVSS Score 10.0 / 10

EPSS Score 2.01%

Top 21% most likely to be exploited

Threat Score 40.6 / 100

Data Sources

NVD EPSS GitHub