All the vulnerabilites related to microfocus - operations_bridge
Vulnerability from fkie_nvd
Published
2020-10-27 17:15
Modified
2024-11-21 04:58
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:application_performance_management:9.50:*:*:*:*:*:*:*",
"matchCriteriaId": "9E3938F6-E50A-480B-8219-0B210983525E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:application_performance_management:9.51:*:*:*:*:*:*:*",
"matchCriteriaId": "C419162B-A41C-49D0-9293-5F10B8A911EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "22CE2A4E-D42B-47F7-BFC1-EA498795D0B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "88D1F756-6699-4046-AC9F-FED971A26B9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "68B8CDAA-33CF-4B9D-954B-1976160A1A76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.08:*:*:*:*:*:*:*",
"matchCriteriaId": "5C945B57-F9CB-4282-9D0E-F552B8AD1AC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7939DB7E-484A-477F-A303-BD5B1EF9BD4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2019.05:*:*:*:*:*:*:*",
"matchCriteriaId": "6212937A-A038-41B6-929E-F8A1C2DB41A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2019.08:*:*:*:*:*:*:*",
"matchCriteriaId": "A28436C6-6A21-4A1D-A1E0-C4F224DB669A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2020.05:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F4EB07-6B54-4EB1-9C47-7D42BADA6C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "95F47B66-7FAD-44C9-9C8C-8DD785F4B297",
"versionEndIncluding": "10.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E38A260-424C-4B73-A502-75394F64AEAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5F0B3E96-BEE7-4F04-8FB7-633C42DEBEA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.60:*:*:*:*:*:*:*",
"matchCriteriaId": "1DEC1A77-DFF5-4E35-BD25-9ED3EEC77702",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.61:*:*:*:*:*:*:*",
"matchCriteriaId": "9328132A-CB29-4252-B0DE-32E1AE402526",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.62:*:*:*:*:*:*:*",
"matchCriteriaId": "6C163191-6D2E-4403-B416-ED29174B5781",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.63:*:*:*:*:*:*:*",
"matchCriteriaId": "C9C552EF-2ADA-4293-8DA6-8EFF201FD2E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A2E37C-69DC-42AC-BE72-475561249F24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2018.11:*:*:*:*:*:*:*",
"matchCriteriaId": "F169AF11-4F4D-4A17-8808-8F5E5822D17C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2019.05:*:*:*:*:*:*:*",
"matchCriteriaId": "65B2691B-246F-4305-943F-392062AD7C9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2019.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CFD9DF2A-E5D3-48DD-8D0A-CD2C333E5354",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2020.05:*:*:*:*:*:*:*",
"matchCriteriaId": "5F113173-2ECD-4FF6-A664-A9AABFD448CA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:application_performance_management:9.40:*:*:*:*:*:*:*",
"matchCriteriaId": "3C520D74-D011-4C1E-9429-BA0A38BC0D28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:universal_cmdb:10.33:cumulative_update_package_3:*:*:*:*:*:*",
"matchCriteriaId": "B7648EAC-3790-4C80-AC6B-70C3745F52AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution."
},
{
"lang": "es",
"value": "Una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo arbitraria en Operation Bridge Manager, Application Performance Management y Operations Bridge (en contenedores). Vulnerabilidad en los productos Micro Focus Operation Bridge Manager, Operation Bridge (containerized) y Application Performance Management.\u0026#xa0;La vulnerabilidad afecta: 1.) Operation Bridge Manager versiones 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 y todas las versiones anteriores.\u0026#xa0;2.) Operations Bridge (en contenedores) versiones: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05.\u0026#xa0;2018.02 y 2017.11.\u0026#xa0;3.) Application Performance Management versiones: 9,51, 9.50 y 9.40 con uCMDB versi\u00f3n 10.33 CUP 3. La vulnerabilidad podr\u00eda permitir una ejecuci\u00f3n de c\u00f3digo Arbitraria"
}
],
"id": "CVE-2020-11854",
"lastModified": "2024-11-21T04:58:45.713",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-10-27T17:15:12.130",
"references": [
{
"source": "security@opentext.com",
"url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747657"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"source": "security@opentext.com",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1287/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747657"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1287/"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-08-30 21:29
Modified
2024-11-21 04:10
Severity ?
8.8 (High) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | data_center_automation | 2017.01 | |
| microfocus | data_center_automation | 2017.05 | |
| microfocus | data_center_automation | 2017.08 | |
| microfocus | data_center_automation | 2017.09 | |
| microfocus | data_center_automation | 2017.11 | |
| microfocus | data_center_automation | 2018.02 | |
| microfocus | data_center_automation | 2018.05 | |
| microfocus | hybrid_cloud_management | 2017.11 | |
| microfocus | hybrid_cloud_management | 2017.11 | |
| microfocus | hybrid_cloud_management | 2018.02 | |
| microfocus | hybrid_cloud_management | 2018.02 | |
| microfocus | hybrid_cloud_management | 2018.05 | |
| microfocus | hybrid_cloud_management | 2018.05 | |
| microfocus | network_operations_management | 2017.11 | |
| microfocus | network_operations_management | 2018.02 | |
| microfocus | network_operations_management | 2018.05 | |
| microfocus | operations_bridge | 2017.11 | |
| microfocus | operations_bridge | 2018.02 | |
| microfocus | operations_bridge | 2018.05 | |
| microfocus | service_management_automation | 2017.11 | |
| microfocus | service_management_automation | 2018.02 | |
| microfocus | service_management_automation | 2018.05 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.01:*:*:*:*:*:*:*",
"matchCriteriaId": "F8CBD371-84AA-45F2-B53C-FF2F94316FDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.05:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA57EDB-69A7-439A-886A-06E844A45CFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.08:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E861D6-7812-4190-A3C1-F338D544123E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.09:*:*:*:*:*:*:*",
"matchCriteriaId": "4CA11555-95A4-4086-9C67-CA4C92EA4D0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "008EA036-C58F-4B01-AEAD-3E8E79304A68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "34E310E2-2F0F-4942-A7CD-61616D366824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "D1CA1EEE-301A-4DB1-ACE6-A8DC7FF101C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "EC84CBAE-0AB4-4405-8423-A221E3BABCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "28F73BBD-DA6B-42A5-BDC9-F8832E475B03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "E52C4EA5-AE1E-476E-9AAF-FB8A6D34658A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "69087F9D-D5F1-462C-8264-13DBCF50474C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "5686CFAC-0091-4B98-9654-359AC77343EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "C7E8812B-28DC-4F66-B395-73AF00E57113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E21E1238-6D5F-4AA5-8FE4-B818D0DBF6C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "EA8F1189-19DF-43EB-9B35-61720EE11357",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "DF75B30C-1E8D-462E-A30A-9C17EF0B7CE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "34099595-3D44-4B10-AA42-5A6DC9B82F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "2D4D7844-FA36-4C63-8AD6-C40F81134DBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "78756DED-D384-4F7F-99C3-6BC6293B1D28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "5166B660-88F2-437B-96DA-F7E44E6AE9A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "2DCFB2E7-D769-4365-9B99-952907563749",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "3909E337-F1FC-45C8-A120-EEBDBFB0E4D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
},
{
"lang": "es",
"value": "Ejecuci\u00f3n remota de c\u00f3digo en los siguientes productos: Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05; Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05; Data Center Automation Containerized Suite 2017.01 hasta la versi\u00f3n 2018.05; Service Management Automation Suite 2017.11, 2018.02, 2018.05 y Network Operations Management (NOM) Suite CDF 2017.11, 2018.02 y 2018.05 permitir\u00e1 la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"id": "CVE-2018-6498",
"lastModified": "2024-11-21T04:10:46.813",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.3,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-08-30T21:29:00.267",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-11-07 16:29
Modified
2024-11-21 03:56
Severity ?
9.6 (Critical) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
8.8 (High) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.02, 2018.05, 2018.08. This vulnerability could allow for information disclosure.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | operations_bridge | 2017.11 | |
| microfocus | operations_bridge | 2018.02 | |
| microfocus | operations_bridge | 2018.05 | |
| microfocus | operations_bridge | 2018.08 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "34099595-3D44-4B10-AA42-5A6DC9B82F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "2D4D7844-FA36-4C63-8AD6-C40F81134DBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "78756DED-D384-4F7F-99C3-6BC6293B1D28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.08:*:*:*:*:*:*:*",
"matchCriteriaId": "5C945B57-F9CB-4282-9D0E-F552B8AD1AC2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.02, 2018.05, 2018.08. This vulnerability could allow for information disclosure."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo y divulgaci\u00f3n de informaci\u00f3n en Micro Focus Operations Bridge, en la suite \"containerized\", en versiones 2017.11, 2018.02, 2018.05 y 2018.08. Esta vulnerabilidad podr\u00eda permitir la divulgaci\u00f3n de informaci\u00f3n."
}
],
"id": "CVE-2018-18590",
"lastModified": "2024-11-21T03:56:13.033",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.5,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 6.0,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-11-07T16:29:00.517",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-08-30 21:29
Modified
2024-11-21 04:10
Severity ?
7.1 (High) - CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.01:*:*:*:*:*:*:*",
"matchCriteriaId": "F8CBD371-84AA-45F2-B53C-FF2F94316FDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.05:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA57EDB-69A7-439A-886A-06E844A45CFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.08:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E861D6-7812-4190-A3C1-F338D544123E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.09:*:*:*:*:*:*:*",
"matchCriteriaId": "4CA11555-95A4-4086-9C67-CA4C92EA4D0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "008EA036-C58F-4B01-AEAD-3E8E79304A68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "34E310E2-2F0F-4942-A7CD-61616D366824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "D1CA1EEE-301A-4DB1-ACE6-A8DC7FF101C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "EC84CBAE-0AB4-4405-8423-A221E3BABCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "28F73BBD-DA6B-42A5-BDC9-F8832E475B03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "E52C4EA5-AE1E-476E-9AAF-FB8A6D34658A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "69087F9D-D5F1-462C-8264-13DBCF50474C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "5686CFAC-0091-4B98-9654-359AC77343EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "C7E8812B-28DC-4F66-B395-73AF00E57113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E21E1238-6D5F-4AA5-8FE4-B818D0DBF6C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "EA8F1189-19DF-43EB-9B35-61720EE11357",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "DF75B30C-1E8D-462E-A30A-9C17EF0B7CE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "34099595-3D44-4B10-AA42-5A6DC9B82F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "2D4D7844-FA36-4C63-8AD6-C40F81134DBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "78756DED-D384-4F7F-99C3-6BC6293B1D28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "5166B660-88F2-437B-96DA-F7E44E6AE9A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "2DCFB2E7-D769-4365-9B99-952907563749",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "3909E337-F1FC-45C8-A120-EEBDBFB0E4D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:network_virtualization:12.50:*:*:*:*:*:*:*",
"matchCriteriaId": "38941402-8B70-45C2-A14C-94B68D10E5FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_virtualization:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "3292BE86-4343-4A86-AB7B-C2EC51ABEABF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:unified_functional_testing:12.50:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C9D71B-481D-46C8-8532-D4781172D442",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:autopass_license_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AB9A56BA-5A4F-4CD3-B1DF-8A452FDB858B",
"versionEndExcluding": "10.7.0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
},
{
"lang": "es",
"value": "Ejecuci\u00f3n remota de c\u00f3digo en los siguientes productos: Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05; Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05; Data Center Automation Containerized Suite 2017.01 hasta la versi\u00f3n 2018.05; Service Management Automation Suite 2017.11, 2018.02, 2018.05; Service Virtualization (SV) con licencias flotantes en cualquier versi\u00f3n que emplea APLS anteriores a 10.7; Unified Functional Testing (UFT) con licencias flotantes en cualquier versi\u00f3n que emplea APLS anteriores a 10.7; Network Virtualization (NV) con licencias flotantes en cualquier versi\u00f3n que emplea APLS anteriores a 10.7 y Network Operations Management (NOM) Suite CDF 2017.11, 2018.02y 2018.05 permitir\u00e1 la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"id": "CVE-2018-6499",
"lastModified": "2024-11-21T04:10:46.950",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.3,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-08-30T21:29:00.390",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-12-08 16:15
Modified
2024-11-21 07:17
Severity ?
8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | operations_bridge | * | |
| microfocus | operations_bridge_manager | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC94A857-6EFE-42B2-83B8-1B92370997D9",
"versionEndExcluding": "2022.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED2BA42-B9F9-4CB5-81FF-2077642280C1",
"versionEndExcluding": "2022.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11."
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad potencial en Micro Focus Operations Bridge - Containerized. La vulnerabilidad podr\u00eda ser aprovechada por un usuario malicioso de OBM (Operations Bridge Manager) autenticado para ejecutar Java Scripts en el contexto del navegador de otro usuario de OBM. Tenga en cuenta: la vulnerabilidad solo es aplicable si se implementa la capacidad de Operations Bridge Manager. Se ha identificado una vulnerabilidad potencial en Micro Focus Operations Bridge Manager (OBM). La vulnerabilidad podr\u00eda ser aprovechada por un usuario malicioso de OBM autenticado para ejecutar Java Scripts en el contexto del navegador de otro usuario de OBM. Este problema afecta a: Versiones de Micro Focus Micro Focus Operations Bridge Manager anteriores a 2022.11. Micro Focus Micro Focus Operations Bridge: versiones en contenedores anteriores a 2022.11."
}
],
"id": "CVE-2022-38754",
"lastModified": "2024-11-21T07:17:01.747",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-12-08T16:15:11.717",
"references": [
{
"source": "security@opentext.com",
"url": "https://marketplace.microfocus.com/itom/content/operations-bridge-manager-obm-2022-05-hotfixes"
},
{
"source": "security@opentext.com",
"url": "https://portal.microfocus.com/s/article/KM000012517?language=en_US"
},
{
"source": "security@opentext.com",
"url": "https://portal.microfocus.com/s/article/KM000012518?language=en_US"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://marketplace.microfocus.com/itom/content/operations-bridge-manager-obm-2022-05-hotfixes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://portal.microfocus.com/s/article/KM000012517?language=en_US"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://portal.microfocus.com/s/article/KM000012518?language=en_US"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-10-27 17:15
Modified
2024-11-21 04:58
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | operations_bridge | 2017.11 | |
| microfocus | operations_bridge | 2018.02 | |
| microfocus | operations_bridge | 2018.05 | |
| microfocus | operations_bridge | 2018.08 | |
| microfocus | operations_bridge | 2018.11 | |
| microfocus | operations_bridge | 2019.05 | |
| microfocus | operations_bridge | 2019.08 | |
| microfocus | operations_bridge | 2020.05 | |
| microfocus | operations_bridge_manager | * | |
| microfocus | operations_bridge_manager | 10.11 | |
| microfocus | operations_bridge_manager | 10.12 | |
| microfocus | operations_bridge_manager | 10.60 | |
| microfocus | operations_bridge_manager | 10.61 | |
| microfocus | operations_bridge_manager | 10.62 | |
| microfocus | operations_bridge_manager | 10.63 | |
| microfocus | operations_bridge_manager | 2018.05 | |
| microfocus | operations_bridge_manager | 2018.11 | |
| microfocus | operations_bridge_manager | 2019.05 | |
| microfocus | operations_bridge_manager | 2019.11 | |
| microfocus | operations_bridge_manager | 2020.05 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "22CE2A4E-D42B-47F7-BFC1-EA498795D0B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "88D1F756-6699-4046-AC9F-FED971A26B9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "68B8CDAA-33CF-4B9D-954B-1976160A1A76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.08:*:*:*:*:*:*:*",
"matchCriteriaId": "5C945B57-F9CB-4282-9D0E-F552B8AD1AC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7939DB7E-484A-477F-A303-BD5B1EF9BD4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2019.05:*:*:*:*:*:*:*",
"matchCriteriaId": "6212937A-A038-41B6-929E-F8A1C2DB41A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2019.08:*:*:*:*:*:*:*",
"matchCriteriaId": "A28436C6-6A21-4A1D-A1E0-C4F224DB669A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2020.05:*:*:*:*:*:*:*",
"matchCriteriaId": "D7F4EB07-6B54-4EB1-9C47-7D42BADA6C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "95F47B66-7FAD-44C9-9C8C-8DD785F4B297",
"versionEndIncluding": "10.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "1E38A260-424C-4B73-A502-75394F64AEAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5F0B3E96-BEE7-4F04-8FB7-633C42DEBEA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.60:*:*:*:*:*:*:*",
"matchCriteriaId": "1DEC1A77-DFF5-4E35-BD25-9ED3EEC77702",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.61:*:*:*:*:*:*:*",
"matchCriteriaId": "9328132A-CB29-4252-B0DE-32E1AE402526",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.62:*:*:*:*:*:*:*",
"matchCriteriaId": "6C163191-6D2E-4403-B416-ED29174B5781",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:10.63:*:*:*:*:*:*:*",
"matchCriteriaId": "C9C552EF-2ADA-4293-8DA6-8EFF201FD2E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A2E37C-69DC-42AC-BE72-475561249F24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2018.11:*:*:*:*:*:*:*",
"matchCriteriaId": "F169AF11-4F4D-4A17-8808-8F5E5822D17C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2019.05:*:*:*:*:*:*:*",
"matchCriteriaId": "65B2691B-246F-4305-943F-392062AD7C9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2019.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CFD9DF2A-E5D3-48DD-8D0A-CD2C333E5354",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge_manager:2020.05:*:*:*:*:*:*:*",
"matchCriteriaId": "5F113173-2ECD-4FF6-A664-A9AABFD448CA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges."
},
{
"lang": "es",
"value": "Una ejecuci\u00f3n de c\u00f3digo con una vulnerabilidad de privilegios escalados en los productos Micro Focus Operation Bridge Manager y Operation Bridge (en contenedores).\u0026#xa0;La vulnerabilidad afecta: 1.) Operation Bridge Manager versiones: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 y todas las versiones anteriores.\u0026#xa0;2.) Operations Bridge (en contenedores) versiones: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05.\u0026#xa0;2018.02 y 2017.11.\u0026#xa0;La vulnerabilidad podr\u00eda permitir a atacantes locales ejecutar c\u00f3digo con privilegios escalados"
}
],
"id": "CVE-2020-11858",
"lastModified": "2024-11-21T04:58:46.137",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-10-27T17:15:12.273",
"references": [
{
"source": "security@opentext.com",
"url": "http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"source": "security@opentext.com",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1326/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1326/"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-04-11 20:15
Modified
2024-11-21 06:16
Severity ?
Summary
Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | operations_bridge | * | |
| microfocus | operations_bridge | 2021.05 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6994AC32-9CA9-4282-BACC-B099ED0C7D75",
"versionStartIncluding": "2021.08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2021.05:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F892E6-F2CD-4946-8DD5-6CBC775FA15D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution."
},
{
"lang": "es",
"value": "Una Ejecuci\u00f3n de c\u00f3digo remoto no autenticado en Micro Focus Operations Bridge en contenedor, afectando a versiones 2021.05, 2021.08 y versiones m\u00e1s recientes de Micro Focus Operations Bridge en contenedor si la implantaci\u00f3n fue actualizada desde 2021.05 o 2021.08. La vulnerabilidad podr\u00eda aprovecharse para una ejecuci\u00f3n de c\u00f3digo remota sin autenticaci\u00f3n"
}
],
"id": "CVE-2021-38125",
"lastModified": "2024-11-21T06:16:26.187",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-04-11T20:15:15.940",
"references": [
{
"source": "security@opentext.com",
"url": "https://portal.microfocus.com/s/article/KM000005303?language=en_US"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://portal.microfocus.com/s/article/KM000005303?language=en_US"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2022-38754
Vulnerability from cvelistv5
Published
2022-12-08 00:00
Modified
2024-08-03 11:02
Severity ?
EPSS score ?
Summary
A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.
References
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | Micro Focus | Micro Focus Operations Bridge Manager |
Version: unspecified < 2022.11 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T11:02:14.430Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://portal.microfocus.com/s/article/KM000012517?language=en_US"
},
{
"tags": [
"x_transferred"
],
"url": "https://portal.microfocus.com/s/article/KM000012518?language=en_US"
},
{
"tags": [
"x_transferred"
],
"url": "https://marketplace.microfocus.com/itom/content/operations-bridge-manager-obm-2022-05-hotfixes"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Micro Focus Operations Bridge Manager",
"vendor": "Micro Focus",
"versions": [
{
"lessThan": "2022.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Micro Focus Operations Bridge- Containerized",
"vendor": "Micro Focus",
"versions": [
{
"lessThan": "2022.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Micro Focus would like to thank Adam Silviu for discovering and reporting the vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"value": "A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-08T00:00:00",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"url": "https://portal.microfocus.com/s/article/KM000012517?language=en_US"
},
{
"url": "https://portal.microfocus.com/s/article/KM000012518?language=en_US"
},
{
"url": "https://marketplace.microfocus.com/itom/content/operations-bridge-manager-obm-2022-05-hotfixes"
}
],
"solutions": [
{
"lang": "en",
"value": "Micro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Micro Focus Operations Bridge - Containerized:\nFor releases older than Micro Focus Operations Bridge - Containerized 2022.11: Upgrade to Micro Focus Operations Bridge - Containerized 2022.11\n\nMicro Focus has made the following mitigation information available to resolve the vulnerability for the impacted versions of Micro Focus Operations Bridge Manager:\nFor releases older than Micro Focus Operations Bridge Manager 2022.05: Upgrade to Micro Focus Operations Manager 2022.11\nFor Micro Focus Operations Bridge Manager 2022.05: Install OBM_2022.05_Consolidated_Hotfix_Nov_2022 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS)",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2022-38754",
"datePublished": "2022-12-08T00:00:00",
"dateReserved": "2022-08-25T00:00:00",
"dateUpdated": "2024-08-03T11:02:14.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-18590
Vulnerability from cvelistv5
Published
2018-11-07 16:00
Modified
2024-09-17 01:15
Severity ?
EPSS score ?
Summary
A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.02, 2018.05, 2018.08. This vulnerability could allow for information disclosure.
References
| ▼ | URL | Tags |
|---|---|---|
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Micro Focus | Operation Bridge Containerized Suite |
Version: 2017.11, 2018.02, 2018.05, 2018.08 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:15:59.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Operation Bridge Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05, 2018.08"
}
]
}
],
"datePublic": "2018-11-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.02, 2018.05, 2018.08. This vulnerability could allow for information disclosure."
}
],
"exploits": [
{
"lang": "en",
"value": "Remote Code Execution"
},
{
"lang": "en",
"value": "Remote Information Disclosure"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
},
{
"descriptions": [
{
"description": "Remote Disclosure of Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:27",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MFSBGN03829 rev.1 - Micro Focus Operation Bridge Containerized Suite, Remote Code Execution",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2018-11-07T14:30:00.000Z",
"ID": "CVE-2018-18590",
"STATE": "PUBLIC",
"TITLE": "MFSBGN03829 rev.1 - Micro Focus Operation Bridge Containerized Suite, Remote Code Execution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Operation Bridge Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05, 2018.08"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11, 2018.02, 2018.05, 2018.08. This vulnerability could allow for information disclosure."
}
]
},
"exploit": [
{
"lang": "en",
"value": "Remote Code Execution"
},
{
"lang": "en",
"value": "Remote Information Disclosure"
}
],
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Remote Disclosure of Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03283416"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2018-18590",
"datePublished": "2018-11-07T16:00:00Z",
"dateReserved": "2018-10-23T00:00:00",
"dateUpdated": "2024-09-17T01:15:29.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-6498
Vulnerability from cvelistv5
Published
2018-08-30 21:00
Modified
2024-09-17 01:11
Severity ?
EPSS score ?
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
References
| ▼ | URL | Tags |
|---|---|---|
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Micro Focus | Network Operations Management (NOM) Suite CDF |
Version: 2017.11, 2018.02, 2018.05 |
||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:49.095Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Network Operations Management (NOM) Suite CDF",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Service Management Automation Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Data Center Automation Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.01 until 2018.05"
}
]
},
{
"product": "Operations Bridge Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Hybrid Cloud Management Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "HCM2017.11, HCM2018.02, HCM2018.05"
}
]
}
],
"datePublic": "2018-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
}
],
"exploits": [
{
"lang": "en",
"value": "Remote Code Execution"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:27",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Micro Focus Container Deployment Foundation (CDF), Remote Code Execution",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2018-08-30T17:00:00.000Z",
"ID": "CVE-2018-6498",
"STATE": "PUBLIC",
"TITLE": "Micro Focus Container Deployment Foundation (CDF), Remote Code Execution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Network Operations Management (NOM) Suite CDF",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Service Management Automation Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Data Center Automation Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.01 until 2018.05"
}
]
}
},
{
"product_name": "Operations Bridge Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Hybrid Cloud Management Containerized Suite",
"version": {
"version_data": [
{
"version_value": "HCM2017.11, HCM2018.02, HCM2018.05"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
}
]
},
"exploit": [
{
"lang": "en",
"value": "Remote Code Execution"
}
],
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2018-6498",
"datePublished": "2018-08-30T21:00:00Z",
"dateReserved": "2018-02-01T00:00:00",
"dateUpdated": "2024-09-17T01:11:00.440Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-6499
Vulnerability from cvelistv5
Published
2018-08-30 21:00
Modified
2024-09-17 04:19
Severity ?
EPSS score ?
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Micro Focus | Network Operations Management (NOM) Suite CDF |
Version: 2017.11, 2018.02, 2018.05 |
||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:49.170Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Network Operations Management (NOM) Suite CDF",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Service Management Automation Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Data Center Automation Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.01 until 2018.05"
}
]
},
{
"product": "Operations Bridge Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Hybrid Cloud Management Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "HCM2017.11, HCM2018.02, HCM2018.05"
}
]
},
{
"product": "Network Virtualization (NV) with floating licenses",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "using Any version using APLS older than 10.7"
}
]
},
{
"product": "Unified Functional Testing (UFT) with floating licenses",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "using Any version using APLS older than 10.7"
}
]
},
{
"product": "Service Virtualization (SV) with floating licenses",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "using Any version using APLS older than 10.7"
}
]
}
],
"datePublic": "2018-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
}
],
"exploits": [
{
"lang": "en",
"value": "Remote Code Execution"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:16:04",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
}
],
"source": {
"defect": [
"Micro",
"Focus",
"Autopass",
"License",
"Server",
"(APLS)",
"Remote",
"Code",
"Execution"
],
"discovery": "UNKNOWN"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2018-08-30T18:00:00.000Z",
"ID": "CVE-2018-6499",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Network Operations Management (NOM) Suite CDF",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Service Management Automation Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Data Center Automation Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.01 until 2018.05"
}
]
}
},
{
"product_name": "Operations Bridge Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Hybrid Cloud Management Containerized Suite",
"version": {
"version_data": [
{
"version_value": "HCM2017.11, HCM2018.02, HCM2018.05"
}
]
}
},
{
"product_name": "Network Virtualization (NV) with floating licenses",
"version": {
"version_data": [
{
"version_value": "using Any version using APLS older than 10.7"
}
]
}
},
{
"product_name": "Unified Functional Testing (UFT) with floating licenses",
"version": {
"version_data": [
{
"version_value": "using Any version using APLS older than 10.7"
}
]
}
},
{
"product_name": "Service Virtualization (SV) with floating licenses",
"version": {
"version_data": [
{
"version_value": "using Any version using APLS older than 10.7"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
}
]
},
"exploit": [
{
"lang": "en",
"value": "Remote Code Execution"
}
],
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
}
]
},
"source": {
"defect": [
"Micro",
"Focus",
"Autopass",
"License",
"Server",
"(APLS)",
"Remote",
"Code",
"Execution"
],
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2018-6499",
"datePublished": "2018-08-30T21:00:00Z",
"dateReserved": "2018-02-01T00:00:00",
"dateUpdated": "2024-09-17T04:19:15.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-11858
Vulnerability from cvelistv5
Published
2020-10-27 16:45
Modified
2024-08-04 11:42
Severity ?
EPSS score ?
Summary
Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| https://softwaresupport.softwaregrp.com/doc/KM03747658 | x_refsource_MISC | |
| https://softwaresupport.softwaregrp.com/doc/KM03747854 | x_refsource_MISC | |
| https://www.zerodayinitiative.com/advisories/ZDI-20-1326/ | x_refsource_MISC | |
| http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | Micro Focus | Operation Bridge (containerized) |
Version: 2020.05 Version: 2019.08 Version: 2019.05 Version: 2018.11 Version: 2018.08 Version: 2018.05 Version: 2018.02 Version: 2017.11 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:42:00.534Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1326/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Operation Bridge (containerized)",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "2020.05"
},
{
"status": "affected",
"version": "2019.08"
},
{
"status": "affected",
"version": "2019.05"
},
{
"status": "affected",
"version": "2018.11"
},
{
"status": "affected",
"version": "2018.08"
},
{
"status": "affected",
"version": "2018.05"
},
{
"status": "affected",
"version": "2018.02"
},
{
"status": "affected",
"version": "2017.11"
}
]
},
{
"product": "Operation Bridge Manager",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "2020.05"
},
{
"status": "affected",
"version": "2019.11"
},
{
"status": "affected",
"version": "2019.05"
},
{
"status": "affected",
"version": "2018.11"
},
{
"status": "affected",
"version": "2018.05"
},
{
"status": "affected",
"version": "10.63"
},
{
"status": "affected",
"version": "10.62"
},
{
"status": "affected",
"version": "10.61"
},
{
"status": "affected",
"version": "10.60"
},
{
"status": "affected",
"version": "10.12"
},
{
"status": "affected",
"version": "10.11"
},
{
"lessThanOrEqual": "10.10",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability"
}
],
"descriptions": [
{
"lang": "en",
"value": "Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges."
}
],
"exploits": [
{
"lang": "en",
"value": "Code execution with escalated privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Code execution with escalated privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-15T17:06:10",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1326/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html"
}
],
"solutions": [
{
"lang": "en",
"value": "For Operation Bridge Manager https://softwaresupport.softwaregrp.com/doc/KM03747658\nFor Operation Bridge (containerized) https://softwaresupport.softwaregrp.com/doc/KM03747854\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products.",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"ID": "CVE-2020-11858",
"STATE": "PUBLIC",
"TITLE": "Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Operation Bridge (containerized)",
"version": {
"version_data": [
{
"version_value": "2020.05"
},
{
"version_value": "2019.08"
},
{
"version_value": "2019.05"
},
{
"version_value": "2018.11"
},
{
"version_value": "2018.08"
},
{
"version_value": "2018.05"
},
{
"version_value": "2018.02"
},
{
"version_value": "2017.11"
}
]
}
},
{
"product_name": "Operation Bridge Manager",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2020.05"
},
{
"version_affected": "=",
"version_value": "2019.11"
},
{
"version_affected": "=",
"version_value": "2019.05"
},
{
"version_affected": "=",
"version_value": "2018.11"
},
{
"version_affected": "=",
"version_value": "2018.05"
},
{
"version_affected": "=",
"version_value": "10.63"
},
{
"version_affected": "=",
"version_value": "10.62"
},
{
"version_affected": "=",
"version_value": "10.61"
},
{
"version_affected": "=",
"version_value": "10.60"
},
{
"version_affected": "=",
"version_value": "10.12"
},
{
"version_affected": "=",
"version_value": "10.11"
},
{
"version_affected": "\u003c=",
"version_value": "10.10"
}
]
}
}
]
},
"vendor_name": "Micro Focus "
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges."
}
]
},
"exploit": [
{
"lang": "en",
"value": "Code execution with escalated privileges."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Code execution with escalated privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03747658",
"refsource": "MISC",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03747854",
"refsource": "MISC",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-1326/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1326/"
},
{
"name": "http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "For Operation Bridge Manager https://softwaresupport.softwaregrp.com/doc/KM03747658\nFor Operation Bridge (containerized) https://softwaresupport.softwaregrp.com/doc/KM03747854\n"
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2020-11858",
"datePublished": "2020-10-27T16:45:12",
"dateReserved": "2020-04-16T00:00:00",
"dateUpdated": "2024-08-04T11:42:00.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-11854
Vulnerability from cvelistv5
Published
2020-10-27 16:29
Modified
2024-08-04 11:42
Severity ?
EPSS score ?
Summary
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.
References
| ▼ | URL | Tags |
|---|---|---|
| https://softwaresupport.softwaregrp.com/doc/KM03747658 | x_refsource_MISC | |
| https://softwaresupport.softwaregrp.com/doc/KM03747657 | x_refsource_MISC | |
| https://softwaresupport.softwaregrp.com/doc/KM03747854 | x_refsource_MISC | |
| https://www.zerodayinitiative.com/advisories/ZDI-20-1287/ | x_refsource_MISC | |
| http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Micro Focus | Application Performance Management |
Version: 9.51 Version: 9.50 Version: 9.40 |
||||||||
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:42:00.149Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747657"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1287/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Application Performance Management ",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "9.51"
},
{
"status": "affected",
"version": "9.50"
},
{
"status": "affected",
"version": "9.40"
}
]
},
{
"product": "Operation Bridge (containerized)",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "2020.05"
},
{
"status": "affected",
"version": "2019.08"
},
{
"status": "affected",
"version": "2019.05"
},
{
"status": "affected",
"version": "2018.11"
},
{
"status": "affected",
"version": "2018.08"
},
{
"status": "affected",
"version": "2018.05"
},
{
"status": "affected",
"version": "2018.02"
},
{
"status": "affected",
"version": "2017.11"
}
]
},
{
"product": "Operation Bridge Manager",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "2020.05"
},
{
"status": "affected",
"version": "2019.11"
},
{
"status": "affected",
"version": "2019.05"
},
{
"status": "affected",
"version": "2018.11"
},
{
"status": "affected",
"version": "2018.05"
},
{
"status": "affected",
"version": "10.63"
},
{
"status": "affected",
"version": "10.62"
},
{
"status": "affected",
"version": "10.61"
},
{
"status": "affected",
"version": "10.60"
},
{
"status": "affected",
"version": "10.12"
},
{
"status": "affected",
"version": "10.11"
},
{
"lessThanOrEqual": "10.10",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability"
}
],
"descriptions": [
{
"lang": "en",
"value": "Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution."
}
],
"exploits": [
{
"lang": "en",
"value": "Arbitrary code execution. "
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Arbitrary code execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-28T15:06:08",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747657"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1287/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"
}
],
"solutions": [
{
"lang": "en",
"value": "For Operation Bridge Manager https://softwaresupport.softwaregrp.com/doc/KM03747658\nFor Operation Bridge (containerized) https://softwaresupport.softwaregrp.com/doc/KM03747854\nFor Application Performance Management https://softwaresupport.softwaregrp.com/doc/KM03747657"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"ID": "CVE-2020-11854",
"STATE": "PUBLIC",
"TITLE": "Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Application Performance Management ",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "9.51"
},
{
"version_affected": "=",
"version_value": "9.50"
},
{
"version_affected": "=",
"version_value": "9.40"
}
]
}
},
{
"product_name": "Operation Bridge (containerized)",
"version": {
"version_data": [
{
"version_value": "2020.05"
},
{
"version_value": "2019.08"
},
{
"version_value": "2019.05"
},
{
"version_value": "2018.11"
},
{
"version_value": "2018.08"
},
{
"version_value": "2018.05"
},
{
"version_value": "2018.02"
},
{
"version_value": "2017.11"
}
]
}
},
{
"product_name": "Operation Bridge Manager",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2020.05"
},
{
"version_affected": "=",
"version_value": "2019.11"
},
{
"version_affected": "=",
"version_value": "2019.05"
},
{
"version_affected": "=",
"version_value": "2018.11"
},
{
"version_affected": "=",
"version_value": "2018.05"
},
{
"version_affected": "=",
"version_value": "10.63"
},
{
"version_affected": "=",
"version_value": "10.62"
},
{
"version_affected": "=",
"version_value": "10.61"
},
{
"version_affected": "=",
"version_value": "10.60"
},
{
"version_affected": "=",
"version_value": "10.12"
},
{
"version_affected": "=",
"version_value": "10.11"
},
{
"version_affected": "\u003c=",
"version_value": "10.10"
}
]
}
}
]
},
"vendor_name": "Micro Focus "
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution."
}
]
},
"exploit": [
{
"lang": "en",
"value": "Arbitrary code execution. "
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Arbitrary code execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03747658",
"refsource": "MISC",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
},
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03747657",
"refsource": "MISC",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747657"
},
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03747854",
"refsource": "MISC",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
},
{
"name": "https://www.zerodayinitiative.com/advisories/ZDI-20-1287/",
"refsource": "MISC",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1287/"
},
{
"name": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "For Operation Bridge Manager https://softwaresupport.softwaregrp.com/doc/KM03747658\nFor Operation Bridge (containerized) https://softwaresupport.softwaregrp.com/doc/KM03747854\nFor Application Performance Management https://softwaresupport.softwaregrp.com/doc/KM03747657"
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2020-11854",
"datePublished": "2020-10-27T16:29:44",
"dateReserved": "2020-04-16T00:00:00",
"dateUpdated": "2024-08-04T11:42:00.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-38125
Vulnerability from cvelistv5
Published
2022-04-11 19:37
Modified
2024-08-04 01:30
Severity ?
EPSS score ?
Summary
Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution.
References
| ▼ | URL | Tags |
|---|---|---|
| https://portal.microfocus.com/s/article/KM000005303?language=en_US | x_refsource_MISC |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | n/a | Operations Bridge containerized. |
Version: 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:30:09.154Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.microfocus.com/s/article/KM000005303?language=en_US"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Operations Bridge containerized.",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Unauthenticated remote code execution.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-11T19:37:49",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.microfocus.com/s/article/KM000005303?language=en_US"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"ID": "CVE-2021-38125",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Operations Bridge containerized.",
"version": {
"version_data": [
{
"version_value": "2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Unauthenticated remote code execution."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.microfocus.com/s/article/KM000005303?language=en_US",
"refsource": "MISC",
"url": "https://portal.microfocus.com/s/article/KM000005303?language=en_US"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2021-38125",
"datePublished": "2022-04-11T19:37:49",
"dateReserved": "2021-08-04T00:00:00",
"dateUpdated": "2024-08-04T01:30:09.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}