PT-2020-20711 · Micro Focus · Micro Focus Service Manager Automation

Published 2020-03-26 · Updated 2020-03-30 · CVE-2020-9521

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Micro Focus Service Manager Automation (SMA) versions 2018.02 through 2019.08

Description An SQL injection issue was discovered, potentially allowing the improper neutralization of special elements in SQL commands. This could make the product vulnerable to SQL injection.

Recommendations For versions 2018.02 through 2019.08, update to a version that includes a fix for the SQL injection vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-9521

Affected Products

Micro Focus Service Manager Automation

References · 4

• https://osv.dev/vulnerability/CVE-2020-9521 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9521 · Security Note
• https://t.me/cvenotify/2199 · Telegram Post
• https://softwaresupport.softwaregrp.com/doc/KM03630615 · Note