Micro Focus Content Manager vulnerabilities

3 CVEs affecting Micro Focus Content Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-11658, published 2019-08-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-3489, published 2019-04-01. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. An unauthenticated file upload vulnerability has been identified in the Web Client component of Micro Focus Content Manager 9.1, 9.2, and 9.3 when configured to use the ADFS authentication method.…
CVE-2019-11653, published 2019-08-07. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Remote Access Control Bypass in Micro Focus Content Manager. versions 9.1, 9.2, 9.3. The vulnerability could be exploited to manipulate data stored during another user’s CheckIn request.
CVE-2019-11658, published 2019-08-30. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid system users to gain access to a limited…