• State Not Answered
  • Replies replies
    2
  • Subscribers subscribers
    17
  • Views views
    1181
  • Users 0 members are here
  • Locked Locked
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ArcSight Logger 7.0.1 hotfix CVE-2020-11839

Kousalya_N
 

Fix for the vulnerability CVE-2020-11839 that was found in ArcSight Logger is now available. Please contact Customer Support to obtain Logger 7.0.1 hotfix CVE-2020-11839. This fix will also be part of the upcoming release of Logger.


CVE-2020-11839: stored XSS
Affected versions: Version 6.6.1 up to 7.0.1
Severity: Medium
CVSS 3.0 Rating: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CWE Reference: 79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Resolution:
Micro Focus recommends to apply the hotfix "Logger 7.0.1 hotfix CVE-2020-11839" on ArcSight Logger 7.01, either in software or appliance form factor. This fix will also be part of the upcoming release of Logger.

Researcher Credit:
For CVE-2020-11839, we would like to give a special thanks to ING Tech Poland, for responsibly disclosing this vulnerability.

Thank you.

  • 0

    Has anyone experienced any issues with installing this Hotfix to Logger 7.0.1?

    Thanks,

    Eric

     

  • 0 in reply to 

    My sample size is 1 L7600 Appliance Logger so not much of a pattern.  The hotfix installed successfully but took about twice as long than expected based upon past experiences with Logger updates.  I've seen this happen before and not be consistent between all our devices of the same type.

     

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.