TI-2020-07620 Aliases CVE-2020-9524 GHSA-4v4v-6cx5-x258

Cross-site scripting in Enterprise Server and Enterprise developer.

LOW 25CWE-79Published 2020-05-18 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS).

Why it matters now

EPSS 0.0051 43rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Enterprise Server and Enterprise developer.	All versions prior to version 5.0 Patch Update 8.	—	No fix listed	CNA

Enterprise Server and Enterprise developer. Vendor— Affected All versions prior to version 5.0 Patch Update 8. Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPE	Versions	Role	Vendor
cpe:2.3:a:microfocus:enterprise_developer:5.0:-::::::	5.0	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p1::::::	5.0 p1	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p2::::::	5.0 p2	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p3::::::	5.0 p3	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p4::::::	5.0 p4	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p5::::::	5.0 p5	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p6::::::	5.0 p6	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p7::::::	5.0 p7	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:-::::::	5.0	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p1::::::	5.0 p1	Vulnerable	Micro Focus International

cpe:2.3:a:microfocus:enterprise_developer:5.0:-:*:*:*:*:*:* Versions 5.0 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p1:*:*:*:*:*:* Versions 5.0 p1 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p2:*:*:*:*:*:* Versions 5.0 p2 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p3:*:*:*:*:*:* Versions 5.0 p3 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p4:*:*:*:*:*:* Versions 5.0 p4 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p5:*:*:*:*:*:* Versions 5.0 p5 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p6:*:*:*:*:*:* Versions 5.0 p6 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_developer:5.0:p7:*:*:*:*:*:* Versions 5.0 p7 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:-:*:*:*:*:*:* Versions 5.0 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p1:*:*:*:*:*:* Versions 5.0 p1 Vulnerable ·Micro Focus International

Show 6 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:microfocus:enterprise_server:5.0:p2::::::	5.0 p2	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p3::::::	5.0 p3	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p4::::::	5.0 p4	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p5::::::	5.0 p5	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p6::::::	5.0 p6	Vulnerable	Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p7::::::	5.0 p7	Vulnerable	Micro Focus International

cpe:2.3:a:microfocus:enterprise_server:5.0:p2:*:*:*:*:*:* Versions 5.0 p2 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p3:*:*:*:*:*:* Versions 5.0 p3 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p4:*:*:*:*:*:* Versions 5.0 p4 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p5:*:*:*:*:*:* Versions 5.0 p5 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p6:*:*:*:*:*:* Versions 5.0 p6 Vulnerable ·Micro Focus International
cpe:2.3:a:microfocus:enterprise_server:5.0:p7:*:*:*:*:*:* Versions 5.0 p7 Vulnerable ·Micro Focus International

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-9524
2026-10-03 Alias added: GHSA-4v4v-6cx5-x258

References

Other 1

https://softwaresupport.softwaregrp.com/doc/KM03640252

TI-2023-04154 Authentication bypass in OpenText (Micro Focus) Enterprise Server CVSS 3.1CRITICAL 9.8
TI-2017-05072 Improper authentication in Micro Focus Enterprise Developer, Micro Focus Enterprise Server CVSS 3.0CRITICAL 9.8
TI-2020-07619 Insufficiently protected credentials in Enterprise developer and server. CVSS 3.1HIGH 8.8
TI-2017-05075 Cross-site request forgery in Micro Focus Enterprise Developer, Micro Focus Enterprise… CVSS 3.0HIGH 8.8
TI-2017-03302 Cross-site request forgery in Micro Focus Enterprise Developer, Micro Focus Enterprise… CVSS 3.0HIGH 8.8
TI-2018-08955 NULL pointer dereference in Micro Focus Enterprise Developer, Micro Focus Enterprise… CVSS 3.0HIGH 7.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences