CVE-2020-9523

Published: Apr 17, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account's security.

Affected (46)

Products: Microfocus: Enterprise Developer, Enterprise Server

Microfocus

2 products

Enterprise Developer

Enterprise Server

Configuration A

23 vulnerable

Vulnerable Software	Affected Versions
Microfocus Enterprise Developer	Up to 3.0
Microfocus Enterprise Developer	Version 4.0
Microfocus Enterprise Developer	Version 4.0 update_10
Microfocus Enterprise Developer	Version 4.0 update_11
Microfocus Enterprise Developer	Version 4.0 update_12
Microfocus Enterprise Developer	Version 4.0 update_13
Microfocus Enterprise Developer	Version 4.0 update_14
Microfocus Enterprise Developer	Version 4.0 update_15
Microfocus Enterprise Developer	Version 4.0 update_1
Microfocus Enterprise Developer	Version 4.0 update_2
Microfocus Enterprise Developer	Version 4.0 update_3
Microfocus Enterprise Developer	Version 4.0 update_4
Microfocus Enterprise Developer	Version 4.0 update_5
Microfocus Enterprise Developer	Version 4.0 update_6
Microfocus Enterprise Developer	Version 4.0 update_7
Microfocus Enterprise Developer	Version 4.0 update_8
Microfocus Enterprise Developer	Version 4.0 update_9
Microfocus Enterprise Developer	Version 5.0
Microfocus Enterprise Developer	Version 5.0 update_1
Microfocus Enterprise Developer	Version 5.0 update_2
Microfocus Enterprise Developer	Version 5.0 update_3
Microfocus Enterprise Developer	Version 5.0 update_4
Microfocus Enterprise Developer	Version 5.0 update_5

Configuration B

23 vulnerable

Vulnerable Software	Affected Versions
Microfocus Enterprise Server	Up to 3.0
Microfocus Enterprise Server	Version 4.0
Microfocus Enterprise Server	Version 4.0 update_10
Microfocus Enterprise Server	Version 4.0 update_11
Microfocus Enterprise Server	Version 4.0 update_12
Microfocus Enterprise Server	Version 4.0 update_13
Microfocus Enterprise Server	Version 4.0 update_14
Microfocus Enterprise Server	Version 4.0 update_15
Microfocus Enterprise Server	Version 4.0 update_1
Microfocus Enterprise Server	Version 4.0 update_2
Microfocus Enterprise Server	Version 4.0 update_3
Microfocus Enterprise Server	Version 4.0 update_4
Microfocus Enterprise Server	Version 4.0 update_5
Microfocus Enterprise Server	Version 4.0 update_6
Microfocus Enterprise Server	Version 4.0 update_7
Microfocus Enterprise Server	Version 4.0 update_8
Microfocus Enterprise Server	Version 4.0 update_9
Microfocus Enterprise Server	Version 5.0
Microfocus Enterprise Server	Version 5.0 update_1
Microfocus Enterprise Server	Version 5.0 update_2
Microfocus Enterprise Server	Version 5.0 update_3
Microfocus Enterprise Server	Version 5.0 update_4
Microfocus Enterprise Server	Version 5.0 update_5

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://softwaresupport.softwaregrp.com/doc/KM03634936

Source: security@opentext.com

https://softwaresupport.softwaregrp.com/doc/KM03634936

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.