CVE-2020-25835: Micro Focus ArcSight Management Center Remote Vulnerability

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-09 · updated 2026-06-17
Weakness: CWE-79

Description

A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resulting in stored Cross-Site Scripting (XSS).

Affected products

ArcSight Management Center.: from 2.9.0 before 2.9.6 — fixed in 2.9.6

How to fix

Upgrade to a fixed version: ArcSight Management Center. 2.9.6. Check the vendor advisory for mitigations.

References

https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-29/5037.ArcMC_5F00_RelNotes_5F00_2_2D00_9_2D00_6.pdf
https://community.microfocus.com/cfs-file/__key/communityserver-wikis-components-files/00-00-00-00-29/5037.ArcMC_5F00_RelNotes_5F00_2_2D00_9_2D00_6.pdf

Get alerted when CVE-2020-25835 or the next vulnerability affects your stack