Medium severity · published May 18, 2020
CVE-2020-9524
Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Enterprise Developer · Microfocus
5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +2 more · source: NVD
ES
Enterprise Server · Microfocus
5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9524
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9524
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03640252
More from Enterprise Developer
9.8
CVE-2023-4501
Authentication bypass in OpenText (Micro Focus) Enterprise Server
9.8
CVE-2017-7420
An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier,…
8.8
CVE-2020-9523
Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0…
8.8
CVE-2017-7423
A Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server 2.3, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2…
8.8
CVE-2017-5187
A Cross-Site Request Forgery (CWE-352) vulnerability in Directory Server (aka Enterprise Server Administration web UI) in Micro Focus Enterprise Developer and Enterprise Server…