Vulnerability in Microfocus Enterprise Developer
CVE-2020-9523
Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account's security.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (57.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 57.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Microfocus Enterprise Developer — versions 4.0, 5.0
- Microfocus Enterprise Server — versions 4.0, 5.0
- Enterprise Developer And Server. — versions All version prior to version 4.0 Patch Update 16, and version 5.0 Patch Update 6.
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2020-9523?
- CVE-2020-9523 is a high-severity vulnerability in Microfocus Enterprise Developer, classified under Insufficiently Protected Credentials. CVSS score: 8.8/10. Published 2020-04-17.
- How severe is CVE-2020-9523?
- High severity. CVSS v3 base score is 8.8 out of 10.