Privilege escalation in Microfocus Netiq Privileged Access Manager
CVE-2020-11846
A vulnerability found in OpenText Privileged Access Manager that issues a token. on successful issuance of the token, a cookie gets set that allows unrestricted access to all the application resources. This issue affects Privileged Access Manager before 3.7.0.1.
Vulnerability class: Privilege Escalation
EPSS: 0.003 (23.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Microfocus Netiq_privileged_access_manager — versions 3.7
- Opentext Privileged Access Manager — versions 3.7.0.1
Weakness classification (CWE)
References
- security@opentext.com (Release Notes)
Frequently asked questions
- What is CVE-2020-11846?
- CVE-2020-11846 is a high-severity vulnerability in Microfocus Netiq Privileged Access Manager, classified under Improper Privilege Management. CVSS score: 8.7/10. Published 2024-08-21.
- How severe is CVE-2020-11846?
- High severity. CVSS v3 base score is 8.7 out of 10.