Medium severity · published Jun 12, 2020
CVE-2020-11839
Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Arcsight Logger · Microfocus
6.61 through 7.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11839
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11839
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03650887
More from Arcsight Logger
9.8
CVE-2020-11851
Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1
9.1
CVE-2023-24470
Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0
8.8
CVE-2019-11657
Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0
7.5
CVE-2022-26330
Potential vulnerabilities have been identified in Micro Focus ArcSight Logger
6.1
CVE-2023-24469
Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0