Login Request a demo
High severity · published Apr 17, 2020
CVE-2020-9523
Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0…
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account's security.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Enterprise Developer · Microfocus
through 3.0; 4.0; 4.0; 4.0; 4.0; 4.0; +17 more · source: NVD
ES
Enterprise Server · Microfocus
through 3.0; 4.0; 4.0; 4.0; 4.0; 4.0; +17 more · source: NVD
Affected product
ED
Enterprise Developer
Microfocus
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9523
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9523
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03634936
More from Enterprise Developer
9.8
CVE-2023-4501
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server…
9.8
CVE-2017-7420
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier,…
8.8
CVE-2017-7423
A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2…
8.8
CVE-2017-5187
A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server…
7.5
CVE-2018-12469
Incorrect handling of an invalid value for an HTTP request parameter by Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and…