CVE-2020-9521

An SQL injection vulnerability was discovered in Micro Focus Service Manager Automation (SMA), affecting versions 2019.08, 2019.05, 2019.02, 2018.08, 2018.05, 2018.02. The vulnerability could allow for the improper neutralization of special elements in SQL commands and may lead to the product being vulnerable to SQL injection.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://softwaresupport.softwaregrp.com/doc/KM03630615

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microfocus:service_manager_automation:2018.02:::::::*
	cpe:2.3:a:microfocus:service_manager_automation:2018.05:::::::*
	cpe:2.3:a:microfocus:service_manager_automation:2018.08:::::::*
	cpe:2.3:a:microfocus:service_manager_automation:2019.02:::::::*
	cpe:2.3:a:microfocus:service_manager_automation:2019.05:::::::*
	cpe:2.3:a:microfocus:service_manager_automation:2019.08:::::::*

History

07 Nov 2023, 03:26

Type	Values Removed	Values Added
References	~~(MISC) https://softwaresupport.softwaregrp.com/doc/KM03630615 - Patch, Vendor Advisory~~	() https://softwaresupport.softwaregrp.com/doc/KM03630615 -

Information

Published : 2020-03-26 15:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-9521

Mitre link : CVE-2020-9521

CVE.ORG link : CVE-2020-9521

JSON object : View

Products Affected

microfocus

service_manager_automation

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2020-9521", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2020-03-26T15:15:25.337", "references": [{"url": "https://softwaresupport.softwaregrp.com/doc/KM03630615", "source": "security@opentext.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An SQL injection vulnerability was discovered in Micro Focus Service Manager Automation (SMA), affecting versions 2019.08, 2019.05, 2019.02, 2018.08, 2018.05, 2018.02. The vulnerability could allow for the improper neutralization of special elements in SQL commands and may lead to the product being vulnerable to SQL injection."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad de inyecci\u00f3n SQL en Micro Focus Service Manager Automation (SMA), afectando a las versiones 2019.08, 2019.05, 2019.02, 2018.08, 2018.05, 2018.02. La vulnerabilidad podr\u00eda permitir la neutralizaci\u00f3n inapropiada de elementos especiales en comandos SQL y puede conllevar a que el producto sea vulnerable a inyecci\u00f3n SQL."}], "lastModified": "2023-11-07T03:26:57.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microfocus:service_manager_automation:2018.02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "483C759E-8522-4BF6-867B-A2A177147C56"}, {"criteria": "cpe:2.3:a:microfocus:service_manager_automation:2018.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0CE1DB1-E27C-4159-8A90-2F230B8A0C30"}, {"criteria": "cpe:2.3:a:microfocus:service_manager_automation:2018.08:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8472E622-E613-4513-9B8B-F9FFDA532700"}, {"criteria": "cpe:2.3:a:microfocus:service_manager_automation:2019.02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "051813D4-0190-41A3-8DFE-05344E392251"}, {"criteria": "cpe:2.3:a:microfocus:service_manager_automation:2019.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCF8F110-B45A-4F2B-B037-C5BCD71EA612"}, {"criteria": "cpe:2.3:a:microfocus:service_manager_automation:2019.08:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F144755-7A9C-4C7F-87B6-24BA24EEE3D7"}], "operator": "OR"}]}], "sourceIdentifier": "security@opentext.com"}