{"id":"CVE-2020-11844","state":"PUBLISHED","title":"Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.","description":"Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.","publishedAt":"2020-05-29T21:15:23.000Z","updatedAt":"2024-08-04T11:42:00.664Z","severity":{"score":10,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"microfocus"},"assigner":"microfocus","products":["Micro Focus Hybrid Cloud Management","Micro Focus ArcSight Investigate. versions","Micro Focus ArcSight Transformation Hub","Micro Focus ArcSight Interset","Micro Focus ArcSight ESM (when ArcSight Fusion","Micro Focus Service Management Automation (SMA)","Micro Focus Operation Bridge Suite (Containerized)","Micro Focus Network Operation Management","Micro Focus Data Center Automation Containerized","Micro Focus Identity Intelligence. versions"],"affected":[{"vendor":"Micro Focus","product":"Hybrid Cloud Management","versions":[{"version":"2018.05","status":"affected","lessThan":"2019.11","versionType":"custom"}]},{"vendor":"Micro Focus","product":"ArcSight Investigate. versions","versions":[{"version":"2.4.0","status":"affected"},{"version":"3.0.0","status":"affected"},{"version":"3.1.0","status":"affected"}]},{"vendor":"Micro Focus","product":"ArcSight Transformation Hub","versions":[{"version":"3.0.0","status":"affected"},{"version":"3.1.0","status":"affected"},{"version":"3.2.0","status":"affected"}]},{"vendor":"Micro Focus","product":"ArcSight Interset","versions":[{"version":"6.0.0","status":"affected"}]},{"vendor":"Micro Focus","product":"ArcSight ESM (when ArcSight Fusion","versions":[{"version":"7.2.1","status":"affected"}]},{"vendor":"Micro Focus","product":"Service Management Automation (SMA)","versions":[{"version":"2018.05","status":"affected"},{"version":"2018.08","status":"affected"},{"version":"2018.11","status":"affected"},{"version":"2019.02","status":"affected"},{"version":"2019.05","status":"affected"},{"version":"2019.08","status":"affected"},{"version":"2019.11","status":"affected"},{"version":"2020.02","status":"affected"}]},{"vendor":"Micro Focus","product":"Operation Bridge Suite (Containerized)","versions":[{"version":"2018.05","status":"affected"},{"version":"2018.08","status":"affected"},{"version":"2018.11","status":"affected"},{"version":"2019.02","status":"affected"},{"version":"2019.05","status":"affected"},{"version":"2019.8","status":"affected"},{"version":"2019.11","status":"affected"}]},{"vendor":"Micro Focus","product":"Network Operation Management","versions":[{"version":"2017.11","status":"affected","lessThanOrEqual":"2019.11","versionType":"custom"}]},{"vendor":"Micro Focus","product":"Data Center Automation Containerized","versions":[{"version":"2018.05","status":"affected"},{"version":"2018.08","status":"affected"},{"version":"2018.11","status":"affected"},{"version":"2019.02","status":"affected"},{"version":"2019.05","status":"affected"},{"version":"2019.08","status":"affected"},{"version":"2019.11","status":"affected"}]},{"vendor":"Micro Focus","product":"Identity Intelligence. versions","versions":[{"version":"1.1.0","status":"affected"},{"version":"next of 1.1.1","status":"unaffected","lessThan":"unspecified","versionType":"custom"}]}],"references":["https://softwaresupport.softwaregrp.com/doc/KM03645636","https://softwaresupport.softwaregrp.com/doc/KM03645642","https://softwaresupport.softwaregrp.com/doc/KM03645631","https://softwaresupport.softwaregrp.com/doc/KM03645630","https://softwaresupport.softwaregrp.com/doc/KM03645629","https://softwaresupport.softwaregrp.com/doc/KM03645628","https://support.microfocus.com/kb/doc.php?id=7024637"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T19:46:24.834Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/11xxx/CVE-2020-11844.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-11844","state":"PUBLISHED","datePublished":"2020-05-29T21:15:23.000Z","dateUpdated":"2024-08-04T11:42:00.664Z","assignerShortName":"microfocus","assignerOrgId":"f81092c5-7f14-476d-80dc-24857f90be84","dateReserved":"2020-04-16T00:00:00.000Z"},"containers":{"cna":{"title":"Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.","descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation."}],"affected":[{"vendor":"Micro Focus","product":"Hybrid Cloud Management","versions":[{"version":"2018.05","status":"affected","lessThan":"2019.11","versionType":"custom"}]},{"vendor":"Micro Focus","product":"ArcSight Investigate. versions","versions":[{"version":"2.4.0","status":"affected"},{"version":"3.0.0","status":"affected"},{"version":"3.1.0","status":"affected"}]},{"vendor":"Micro Focus","product":"ArcSight Transformation Hub","versions":[{"version":"3.0.0","status":"affected"},{"version":"3.1.0","status":"affected"},{"version":"3.2.0","status":"affected"}]},{"vendor":"Micro Focus","product":"ArcSight Interset","versions":[{"version":"6.0.0","status":"affected"}]},{"vendor":"Micro Focus","product":"ArcSight ESM (when ArcSight Fusion","versions":[{"version":"7.2.1","status":"affected"}]},{"vendor":"Micro Focus","product":"Service Management Automation (SMA)","versions":[{"version":"2018.05","status":"affected"},{"version":"2018.08","status":"affected"},{"version":"2018.11","status":"affected"},{"version":"2019.02","status":"affected"},{"version":"2019.05","status":"affected"},{"version":"2019.08","status":"affected"},{"version":"2019.11","status":"affected"},{"version":"2020.02","status":"affected"}]},{"vendor":"Micro Focus","product":"Operation Bridge Suite (Containerized)","versions":[{"version":"2018.05","status":"affected"},{"version":"2018.08","status":"affected"},{"version":"2018.11","status":"affected"},{"version":"2019.02","status":"affected"},{"version":"2019.05","status":"affected"},{"version":"2019.8","status":"affected"},{"version":"2019.11","status":"affected"}]},{"vendor":"Micro Focus","product":"Network Operation Management","versions":[{"version":"2017.11","status":"affected","lessThanOrEqual":"2019.11","versionType":"custom"}]},{"vendor":"Micro Focus","product":"Data Center Automation Containerized","versions":[{"version":"2018.05","status":"affected"},{"version":"2018.08","status":"affected"},{"version":"2018.11","status":"affected"},{"version":"2019.02","status":"affected"},{"version":"2019.05","status":"affected"},{"version":"2019.08","status":"affected"},{"version":"2019.11","status":"affected"}]},{"vendor":"Micro Focus","product":"Identity Intelligence. versions","versions":[{"version":"1.1.0","status":"affected"},{"version":"next of 1.1.1","status":"unaffected","lessThan":"unspecified","versionType":"custom"}]}],"references":[{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645636","tags":["x_refsource_CONFIRM"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645642","tags":["x_refsource_CONFIRM"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645631","tags":["x_refsource_CONFIRM"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645630","tags":["x_refsource_CONFIRM"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645629","tags":["x_refsource_CONFIRM"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645628","tags":["x_refsource_CONFIRM"]},{"url":"https://support.microfocus.com/kb/doc.php?id=7024637","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"microfocus","dateUpdated":"2021-01-06T16:15:54.000Z","orgId":"f81092c5-7f14-476d-80dc-24857f90be84"},"exploits":[{"lang":"en","value":"CWE-863 Incorrect Authorization"}],"solutions":[{"lang":"en","value":"For Data Center Automation Containerized https://softwaresupport.softwaregrp.com/doc/KM03645628\nFor Network Operation Management https://softwaresupport.softwaregrp.com/doc/KM03645629\nFor Operation Bridge Suite https://softwaresupport.softwaregrp.com/doc/KM03645630\nFor SMA https://softwaresupport.softwaregrp.com/doc/KM03645631\nFor ArcSight apps https://softwaresupport.softwaregrp.com/doc/KM03645642\nFor Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03645636\nFor Identity Intelligence https://support.microfocus.com/kb/doc.php?id=7024637\" } ] }"}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@microfocus.com","ID":"CVE-2020-11844","STATE":"PUBLIC","TITLE":"Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products."},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Hybrid Cloud Management","version":{"version_data":[{"version_affected":"<","version_name":"2018.05","version_value":"2019.11"}]}},{"product_name":"ArcSight Investigate. versions","version":{"version_data":[{"version_affected":"=","version_value":"2.4.0"},{"version_affected":"=","version_value":"3.0.0"},{"version_affected":"=","version_value":"3.1.0"}]}},{"product_name":"ArcSight Transformation Hub","version":{"version_data":[{"version_affected":"=","version_value":"3.0.0"},{"version_affected":"=","version_value":"3.1.0"},{"version_affected":"=","version_value":"3.2.0"}]}},{"product_name":"ArcSight Interset","version":{"version_data":[{"version_affected":"=","version_value":"6.0.0"}]}},{"product_name":"ArcSight ESM (when ArcSight Fusion","version":{"version_data":[{"version_affected":"=","version_value":"7.2.1"}]}},{"product_name":"Service Management Automation (SMA)","version":{"version_data":[{"version_affected":"=","version_value":"2018.05"},{"version_affected":"=","version_value":"2018.08"},{"version_affected":"=","version_value":"2018.11"},{"version_affected":"=","version_value":"2019.02"},{"version_affected":"=","version_value":"2019.05"},{"version_affected":"=","version_value":"2019.08"},{"version_affected":"=","version_value":"2019.11"},{"version_affected":"=","version_value":"2020.02"}]}},{"product_name":"Operation Bridge Suite (Containerized)","version":{"version_data":[{"version_affected":"=","version_value":"2018.05"},{"version_affected":"=","version_value":"2018.08"},{"version_affected":"=","version_value":"2018.11"},{"version_affected":"=","version_value":"2019.02"},{"version_affected":"=","version_value":"2019.05"},{"version_affected":"=","version_value":"2019.8"},{"version_affected":"=","version_value":"2019.11"}]}},{"product_name":"Network Operation Management","version":{"version_data":[{"version_affected":"<=","version_name":"2017.11","version_value":"2019.11"}]}},{"product_name":"Data Center Automation Containerized","version":{"version_data":[{"version_affected":"=","version_value":"2018.05"},{"version_affected":"=","version_value":"2018.08"},{"version_affected":"=","version_value":"2018.11"},{"version_affected":"=","version_value":"2019.02"},{"version_affected":"=","version_value":"2019.05"},{"version_affected":"=","version_value":"2019.08"},{"version_affected":"=","version_value":"2019.11"}]}},{"product_name":"Identity Intelligence. versions","version":{"version_data":[{"version_affected":"=","version_value":"1.1.0"},{"version_affected":"!>","version_value":"1.1.1"}]}}]},"vendor_name":"Micro Focus"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation."}]},"exploit":[{"lang":"en","value":"CWE-863 Incorrect Authorization"}],"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-863 Incorrect Authorization"}]}]},"references":{"reference_data":[{"name":"https://softwaresupport.softwaregrp.com/doc/KM03645636","refsource":"CONFIRM","url":"https://softwaresupport.softwaregrp.com/doc/KM03645636"},{"name":"https://softwaresupport.softwaregrp.com/doc/KM03645642","refsource":"CONFIRM","url":"https://softwaresupport.softwaregrp.com/doc/KM03645642"},{"name":"https://softwaresupport.softwaregrp.com/doc/KM03645631","refsource":"CONFIRM","url":"https://softwaresupport.softwaregrp.com/doc/KM03645631"},{"name":"https://softwaresupport.softwaregrp.com/doc/KM03645630","refsource":"CONFIRM","url":"https://softwaresupport.softwaregrp.com/doc/KM03645630"},{"name":"https://softwaresupport.softwaregrp.com/doc/KM03645629","refsource":"CONFIRM","url":"https://softwaresupport.softwaregrp.com/doc/KM03645629"},{"name":"https://softwaresupport.softwaregrp.com/doc/KM03645628","refsource":"CONFIRM","url":"https://softwaresupport.softwaregrp.com/doc/KM03645628"},{"name":"https://support.microfocus.com/kb/doc.php?id=7024637","refsource":"CONFIRM","url":"https://support.microfocus.com/kb/doc.php?id=7024637"}]},"solution":[{"lang":"en","value":"For Data Center Automation Containerized https://softwaresupport.softwaregrp.com/doc/KM03645628\nFor Network Operation Management https://softwaresupport.softwaregrp.com/doc/KM03645629\nFor Operation Bridge Suite https://softwaresupport.softwaregrp.com/doc/KM03645630\nFor SMA https://softwaresupport.softwaregrp.com/doc/KM03645631\nFor ArcSight apps https://softwaresupport.softwaregrp.com/doc/KM03645642\nFor Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03645636\nFor Identity Intelligence https://support.microfocus.com/kb/doc.php?id=7024637\" } ] }"}],"source":{"discovery":"INTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645636","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645642","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645631","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645630","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645629","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645628","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://support.microfocus.com/kb/doc.php?id=7024637","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T11:42:00.664Z"}}]}}}