Read the docs
TI-2020-09514 Aliases CVE-2020-11844GHSA-99j9-w4cp-4529

Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.

Priority MEDIUM 47CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.

Why it matters now

EPSS 0.02057 81st percentileScored 2026-11-07
Fix Fixed Hybrid Cloud Management (Micro Focus): 2019.11Identity Intelligence. versions (Micro Focus): next of 1.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Micro FocusHybrid Cloud Management2018.05 to before 2019.112019.11Patch availableCNA
Micro FocusArcSight Investigate. versions2.4.0; 3.0.0; 3.1.0—No fix listedCNA
Micro FocusArcSight Transformation Hub3.0.0; 3.1.0; 3.2.0—No fix listedCNA
Micro FocusArcSight Interset6.0.0—No fix listedCNA
Micro FocusArcSight ESM (when ArcSight Fusion7.2.1—No fix listedCNA
Micro FocusService Management Automation (SMA)2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.08; 2019.11; 2020.02—No fix listedCNA
Micro FocusOperation Bridge Suite (Containerized)2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.8; 2019.11—No fix listedCNA
Micro FocusNetwork Operation Management2017.11 – 2019.11—No fix listedCNA
Micro FocusData Center Automation Containerized2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.08; 2019.11—No fix listedCNA
Micro FocusIdentity Intelligence. versions1.1.0next of 1.1.1Patch availableCNA
  • Hybrid Cloud Management VendorMicro Focus Affected 2018.05 to before 2019.11 Fixed in 2019.11 Patch available CNA
  • ArcSight Investigate. versions VendorMicro Focus Affected 2.4.0; 3.0.0; 3.1.0 Fixed in — No fix listed CNA
  • ArcSight Transformation Hub VendorMicro Focus Affected 3.0.0; 3.1.0; 3.2.0 Fixed in — No fix listed CNA
  • ArcSight Interset VendorMicro Focus Affected 6.0.0 Fixed in — No fix listed CNA
  • ArcSight ESM (when ArcSight Fusion VendorMicro Focus Affected 7.2.1 Fixed in — No fix listed CNA
  • Service Management Automation (SMA) VendorMicro Focus Affected 2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.08; 2019.11; 2020.02 Fixed in — No fix listed CNA
  • Operation Bridge Suite (Containerized) VendorMicro Focus Affected 2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.8; 2019.11 Fixed in — No fix listed CNA
  • Network Operation Management VendorMicro Focus Affected 2017.11 – 2019.11 Fixed in — No fix listed CNA
  • Data Center Automation Containerized VendorMicro Focus Affected 2018.05; 2018.08; 2018.11; 2019.02; 2019.05; 2019.08; 2019.11 Fixed in — No fix listed CNA
  • Identity Intelligence. versions VendorMicro Focus Affected 1.1.0 Fixed in next of 1.1.1 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*2018.05VulnerableMicro Focus International
cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:*2018.08VulnerableMicro Focus International
cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:*2018.11VulnerableMicro Focus International
cpe:2.3:a:microfocus:service_management_automation:2019.02:*:*:*:*:*:*:*2019.02VulnerableMicro Focus International
cpe:2.3:a:microfocus:service_management_automation:2019.05:*:*:*:*:*:*:*2019.05VulnerableMicro Focus International
cpe:2.3:a:microfocus:service_management_automation:2019.08:*:*:*:*:*:*:*2019.08VulnerableMicro Focus International
cpe:2.3:a:microfocus:service_management_automation:2019.11:*:*:*:*:*:*:*2019.11VulnerableMicro Focus International
cpe:2.3:a:microfocus:service_management_automation:2020.02:*:*:*:*:*:*:*2020.02VulnerableMicro Focus International
  • cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:* Versions 2018.05 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:* Versions 2018.08 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:* Versions 2018.11 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:service_management_automation:2019.02:*:*:*:*:*:*:* Versions 2019.02 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:service_management_automation:2019.05:*:*:*:*:*:*:* Versions 2019.05 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:service_management_automation:2019.08:*:*:*:*:*:*:* Versions 2019.08 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:service_management_automation:2019.11:*:*:*:*:*:*:* Versions 2019.11 Vulnerable ·Micro Focus International
  • cpe:2.3:a:microfocus:service_management_automation:2020.02:*:*:*:*:*:*:* Versions 2020.02 Vulnerable ·Micro Focus International

Remediation

  • Fix · CNA Hybrid Cloud Management (Micro Focus) Fixed in 2019.11
  • Fix · CNA Identity Intelligence. versions (Micro Focus) Fixed in next of 1.1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11844
  2. 2026-10-03 Alias added: GHSA-99j9-w4cp-4529

References

Other 7

  • TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
  • TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 10.0
  • TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
  • TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 9.1
  • TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences