Vulnerability · Published Oct 22, 2020 · Assigned by microfocus
CVE-2020-11853Arbitrary code execution vulnerability on multiple Micro Focus products
High 8.8
In plain English
A high-severity security flaw in Application Performance Management from Micro Focus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 77.0% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.
Official description
Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Micro Focus | Operation Bridge Manager | 2020.52019.112019.052018.112018.05unspecified – through 10.63 |
| Micro Focus | Application Performance Management | 9.519.509.40 |
| Micro Focus | Data Center Automation | 2019.11 |
| Micro Focus | Operations Bridge (containerized) | 2019.112019.082019.052018.112018.082018.052018.022017.11 |
| Micro Focus | Universal CMDB | 2020.052019.112019.052019.022018.112018.082018.0511.0 |
| Micro Focus | Hybrid Cloud Management | 2018.05 – through 2020.05 |
| Micro Focus | Service Management Automation | 2020.052020.02 |
References
- https://softwaresupport.softwaregrp.com/doc/KM03747658 x_refsource_MISC
- https://softwaresupport.softwaregrp.com/doc/KM03747657 x_refsource_MISC
- https://softwaresupport.softwaregrp.com/doc/KM03747854 x_refsource_MISC
- https://softwaresupport.softwaregrp.com/doc/KM03749879 x_refsource_MISC
- https://softwaresupport.softwaregrp.com/doc/KM03747949 x_refsource_MISC
- https://softwaresupport.softwaregrp.com/doc/KM03747948 x_refsource_MISC
- https://softwaresupport.softwaregrp.com/doc/KM03747950 x_refsource_MISC
- http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html x_refsource_MISC
- http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html x_refsource_MISC