Medium severity · published Dec 11, 2020
CVE-2020-25838
Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product. Affecting all 3.x and 4.x versions. The vulnerability could be exploited to disclose unauthorized sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Filr · Microfocus
3.0 before 3.4.8; 4.0 before 4.2.1.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25838
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03767186
More from Filr
7.8
CVE-2019-3475
Local privilege escalation in Filr famtd
7.2
CVE-2023-32268
Exposure of Proxy Administrator Credentials An authenticated administrator equivalent Filr user can access the credentials of proxy administrators
6.5
CVE-2019-3474
Path traversal vulnerability in Filr web application
5.4
CVE-2020-25832
Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1
5.3
CVE-2022-38755
A vulnerability has been identified in Micro Focus Filr in versions prior to 4.3.1.1