{"id":"CVE-2020-11844","aliases":["EUVD-2020-4184","GHSA-99j9-w4cp-4529"],"status":"published","title":"Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.","description":"Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02057,"percentile":0.81465,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2020-05-29T21:15:23Z","modified":"2026-06-17T02:50:53Z","products":[{"vendor":"micro focus","product":"arcsight esm (when arcsight fusion"},{"vendor":"micro focus","product":"arcsight interset"},{"vendor":"micro focus","product":"arcsight investigate. versions"},{"vendor":"micro focus","product":"arcsight transformation hub"},{"vendor":"micro focus","product":"data center automation containerized"},{"vendor":"micro focus","product":"hybrid cloud management"},{"vendor":"micro focus","product":"identity intelligence. versions"},{"vendor":"micro focus","product":"network operation management"},{"vendor":"micro focus","product":"operation bridge suite (containerized)"},{"vendor":"micro focus","product":"service management automation (sma)"},{"vendor":"microfocus","product":"service_management_automation"}],"references":[{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645636","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645642","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645631","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645630","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645629","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03645628","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://support.microfocus.com/kb/doc.php?id=7024637","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11844"},{"url":"https://github.com/advisories/GHSA-99j9-w4cp-4529"}],"sources":{"cve":[{"id":"CVE-2020-11844","title":"Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.","description":"Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.","status":"published","published":"2020-05-29T21:15:23Z","modified":"2024-08-04T11:42:00.664Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-4184","description":"Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.","status":"published","published":"2020-05-29T21:15:23Z","modified":"2024-08-04T11:42:00Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:07:41.956166Z"}],"ghsa":[{"id":"GHSA-99j9-w4cp-4529","title":"There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation ...","description":"There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.","status":"published","published":"2022-05-24T17:18:54Z","modified":"2023-01-29T05:02:39Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:45:08.540426Z"}],"nvd":[{"id":"CVE-2020-11844","description":"Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.","status":"published","published":"2020-05-29T22:15:10.473Z","modified":"2026-06-17T02:50:53.927Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:06:04.922138Z"}]}}