Security readout for executives and security teams
Plain-English summary
CVE-2020-11860 is a remotely exploitable cross-site scripting issue in Micro Focus ArcSight Logger before version 7.1.1. XSS can let an attacker run unwanted browser-side script in a user’s session. The sources do not provide CVSS scoring, exploit details, or evidence of active exploitation.
Executive priority
Treat this as a product-specific remediation item for ArcSight Logger owners. Business urgency depends on whether vulnerable Logger web interfaces are broadly reachable and whether privileged users access them. The lack of severity scoring and exploitation evidence reduces certainty, not the need to upgrade affected systems.
Technical view
The CVE record describes a Cross-Site Scripting vulnerability affecting all Micro Focus ArcSight Logger versions prior to 7.1.1. The available public bundle does not identify the affected endpoint, required privileges, user interaction, CVSS vector, CWE, or specific remediation details beyond the fixed-version boundary.
Likely exposure
Exposure is limited to organizations running Micro Focus ArcSight Logger versions earlier than 7.1.1, especially where the web interface is reachable by users or administrators. The provided sources do not identify cloud exposure, default configuration exposure, or internet-facing prevalence.
Exploitation context
The CVE says the vulnerability could be remotely exploited for XSS. It is not listed as CISA KEV in the supplied bundle, and no cited source confirms active exploitation, public exploit availability, or exploitation in the wild.
Researcher notes
Public data is sparse. The record identifies XSS, remote exploitability, product, and affected version range, but omits endpoint, preconditions, privileges, user interaction, and impact scope. Avoid assuming stored versus reflected XSS without vendor details or independent analysis.
Mitigation direction
- Upgrade ArcSight Logger deployments running versions before 7.1.1 to version 7.1.1 or later.
- Review Micro Focus Logger 7.1.1 release notes and support guidance for remediation details.
- Prioritize remediation for Logger interfaces reachable by many users or untrusted networks.
- Track any unsupported legacy Logger deployments as residual risk until replaced or remediated.
Validation and detection
- Inventory all ArcSight Logger deployments and record exact versions.
- Flag every Logger instance running a version earlier than 7.1.1.
- Confirm whether Logger web interfaces are reachable from user, partner, or internet-facing networks.
- Review vendor release notes to verify the fixed build and any deployment prerequisites.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-11860 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://community.microfocus.com/t5/Logger/Logger-Release-Notes-7-1-1/ta-p/2837600CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.