Log in Start free

Vulnerability · Published Oct 27, 2020 · Assigned by microfocus

CVE-2020-11854Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.

Critical 9.8

In plain English

A critical-severity security flaw in Application Performance Management from Micro Focus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 74.4% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)74.4%top 0.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Metasploit, Nuclei

Official description

Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.

Affected products (as reported)

VendorProductVersions
Micro Focus Application Performance Management 9.519.509.40
Micro Focus Operation Bridge (containerized) 2020.052019.082019.052018.112018.082018.052018.022017.11
Micro Focus Operation Bridge Manager 2020.052019.112019.052018.112018.0510.6310.6210.61

References