Medium severity · published Dec 8, 2022
CVE-2022-38754
A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Operations Bridge · Microfocus
before 2022.11 · source: NVD
OB
Operations Bridge Manager · Microfocus
before 2022.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38754
marketplace.microfocus.com
https://marketplace.microfocus.com/itom/content/operations-bridge-manager-obm-2022-05-hotfixes
portal.microfocus.com
https://portal.microfocus.com/s/article/KM000012517?language=en_US
portal.microfocus.com
https://portal.microfocus.com/s/article/KM000012518?language=en_US
More from Operations Bridge
9.8
CVE-2021-38125
Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge…
9.8
CVE-2020-11854
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products…
9.8
CVE-2018-6499
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11,…
9.8
CVE-2018-6498
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11,…
8.8
CVE-2018-18590
A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.02, 2018.05, 2018.08