PT-2020-12889 · Micro Focus · Data Center Automation+10

Published 2020-05-29 · Updated 2021-05-12 · CVE-2020-11844

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hybrid Cloud Management versions 2018.05 through 2019.11 ArcSight Investigate versions 2.4.0 through 3.1.0 ArcSight Transformation Hub versions 3.0.0 through 3.2.0 ArcSight Interset version 6.0.0 ArcSight ESM version 7.2.1 Service Management Automation (SMA) versions 2018.05 through 2020.02 Operation Bridge Suite (Containerized) versions 2018.05 through 2020.02 Network Operation Management versions 2017.11 through 2019.11 Data Center Automation Containerized versions 2018.05 through 2019.11 Identity Intelligence versions 1.1.0 through 1.1.1

Description The issue is related to an Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation component. This vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.

Recommendations For Hybrid Cloud Management versions 2018.05 through 2019.11, update to a version outside of this range to resolve the issue. For ArcSight Investigate versions 2.4.0 through 3.1.0, update to a version outside of this range to resolve the issue. For ArcSight Transformation Hub versions 3.0.0 through 3.2.0, update to a version outside of this range to resolve the issue. For ArcSight Interset version 6.0.0, update to a version outside of this range to resolve the issue. For ArcSight ESM version 7.2.1, update to a version outside of this range to resolve the issue. For Service Management Automation (SMA) versions 2018.05 through 2020.02, update to a version outside of this range to resolve the issue. For Operation Bridge Suite (Containerized) versions 2018.05 through 2020.02, update to a version outside of this range to resolve the issue. For Network Operation Management versions 2017.11 through 2019.11, update to a version outside of this range to resolve the issue. For Data Center Automation Containerized versions 2018.05 through 2019.11, update to a version outside of this range to resolve the issue. For Identity Intelligence versions 1.1.0 through 1.1.1, update to a version outside of this range to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-11844

Affected Products

Arcsight Esm

Arcsight Interset

Arcsight Investigate

Arcsight Transformation Hub

Container Deployment Foundation

Data Center Automation

Hybrid Cloud Management

Identity Intelligence

Network Operation Management

Operation Bridge Suite

Service Management Automation

References · 12

• https://osv.dev/vulnerability/CVE-2020-11844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11844 · Security Note
• https://t.me/cvenotify/4092 · Telegram Post
• https://softwaresupport.softwaregrp.com/doc/KM03645636 · Note
• https://softwaresupport.softwaregrp.com/doc/KM03645642 · Note
• https://t.me/cibsecurity/12426 · Telegram Post
• https://support.microfocus.com/kb/doc.php?id=7024637 · Note
• https://softwaresupport.softwaregrp.com/doc/KM03645629 · Note
• https://softwaresupport.softwaregrp.com/doc/KM03645631 · Note
• https://softwaresupport.softwaregrp.com/doc/KM03645628 · Note
• https://softwaresupport.softwaregrp.com/doc/KM03645630 · Note
• https://t.me/cvenotify/14335 · Telegram Post