What’s Vulnerable › Vulnerabilities

CVE-2020-11849: Elevation of privilege and unauthorized access in Micro Focus Identity Manager product

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-08 · updated 2026-06-17

Description

Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager. Affecting versions prior to 4.7.3 and 4.8.1 hot fix 1. The vulnerability could allow information exposure that can result in an elevation of privilege or an unauthorized access.

Affected products

• Micro Fosus Identity Manager: before 4.7.3; 4.7.4, 4.8.1 — fixed in 4.7.3

How to fix

Upgrade to a fixed version: Micro Fosus Identity Manager 4.7.3. Check the vendor advisory for mitigations.

References

• https://www.netiq.com/documentation/identity-manager-47/releasenotes_idm4741_apps/data/releasenotes_idm4741_apps.html
• https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4811_apps/data/releasenotes_idm4811_apps.html
• https://www.netiq.com/documentation/identity-manager-47/releasenotes_idm4741_apps/data/releasenotes_idm4741_apps.html
• https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4811_apps/data/releasenotes_idm4811_apps.html

Get alerted when CVE-2020-11849 or the next vulnerability affects your stack