High severity · published Oct 22, 2020
CVE-2020-11853
Arbitrary code execution vulnerability affecting multiple Micro Focus products
8.8
CVSS
77%
EPSS
No
On KEV
Description
Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)77.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Application Performance Management · Microfocus
9.40; 9.50; 9.51 · source: NVD
DC
Data Center Automation · Microfocus
through 2019.11 · source: NVD
HC
Hybrid Cloud Management · Microfocus
2018.05 through 2020.05 · source: NVD
OB
Operation Bridge Manager · Microfocus
through 10.10; 10.11; 10.12; 10.60; 10.61; 10.62; +1 more · source: NVD
OB
Operations Bridge Manager · Microfocus
2017.11; 2018.02; 2018.05; 2018.08; 2018.11; 2019.05; +3 more · source: NVD
SM
Service Manager Automation · Microfocus
2020.02; 2020.05 · source: NVD
UC
Universal Cmbd Foundation · HP
10.20; 10.30; 10.31; 10.32; 10.33; 11.0; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11853
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11853
packetstormsecurity.com
http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html
packetstormsecurity.com
http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03747657
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03747658
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03747854
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03747948
More from Universal Cmbd Foundation
9.8
CVE-2016-4368
HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute…
7.5
CVE-2016-4367
The Universal Discovery component in HPE Universal CMDB 10.0, 10.01, 10.10, 10.11, 10.20, and 10.21 allows remote attackers to obtain sensitive information via unspecified vectors
7.4
CVE-2016-2001
HPE Universal CMDB Foundation 10.0, 10.01, 10.10, 10.11, and 10.20 allows remote attackers to obtain sensitive information or conduct URL redirection attacks via unspecified…