Critical severity · published Jul 8, 2020
CVE-2020-11849
Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager. Affecting versions prior to 4.7.3 and 4.8.1 hot fix 1. The vulnerability could allow information exposure that can result in an elevation of privilege or an unauthorized access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Identity Manager · Microfocus
before 4.7.3; 4.7.4; 4.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11849
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11849
www.netiq.com
https://www.netiq.com/documentation/identity-manager-47/releasenotes_idm4741_apps/data/releasenotes_idm4741_apps.html
www.netiq.com
https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4811_apps/data/releasenotes_idm4811_apps.html
More from Identity Manager
9.8
CVE-2020-25839
NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability
7.5
CVE-2016-1600
The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability