Vulnerability-Lookup

CNVD-2020-64760

Vulnerability from cnvd - Published: 2020-11-20

Title

Micro Focus Operation Bridge Manager代码注入漏洞

Description

Micro Focus Operation Bridge Manager是英国Micro Focus公司的一款企业级监控软件。该软件通过HTML5来可视化总结服务运行状况。 Micro Focus Operation Bridge Manager 多版本存在代码注入漏洞。该漏洞可能允许远程攻击者执行任意代码。

Severity

中

Patch Name

Micro Focus Operation Bridge Manager代码注入漏洞的补丁

Patch Description

Micro Focus Operation Bridge Manager是英国Micro Focus公司的一款企业级监控软件。该软件通过HTML5来可视化总结服务运行状况。 Micro Focus Operation Bridge Manager 多版本存在代码注入漏洞。该漏洞可能允许远程攻击者执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://softwaresupport.softwaregrp.com/doc/KM03747658

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-11853

Impacted products

Name
['Micro Focus Micro Focus Operation Bridge Manager 2020.05', 'Micro Focus Micro Focus Operation Bridge Manager 2019.11', 'Micro Focus Micro Focus Operation Bridge Manager 2019.05', 'Micro Focus Micro Focus Operation Bridge Manager 2018.11', 'Micro Focus Micro Focus Operation Bridge Manager 2018.05', 'Micro Focus Micro Focus Operation Bridge Manager 10.6x', 'Micro Focus Micro Focus Operation Bridge Manager <=10.1x']

Name

['Micro Focus Micro Focus Operation Bridge Manager 2020.05', 'Micro Focus Micro Focus Operation Bridge Manager 2019.11', 'Micro Focus Micro Focus Operation Bridge Manager 2019.05', 'Micro Focus Micro Focus Operation Bridge Manager 2018.11', 'Micro Focus Micro Focus Operation Bridge Manager 2018.05', 'Micro Focus Micro Focus Operation Bridge Manager 10.6x', 'Micro Focus Micro Focus Operation Bridge Manager <=10.1x']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-11853",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-11853"
    }
  },
  "description": "Micro Focus Operation Bridge Manager\u662f\u82f1\u56fdMicro Focus\u516c\u53f8\u7684\u4e00\u6b3e\u4f01\u4e1a\u7ea7\u76d1\u63a7\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u901a\u8fc7HTML5\u6765\u53ef\u89c6\u5316\u603b\u7ed3\u670d\u52a1\u8fd0\u884c\u72b6\u51b5\u3002\n\nMicro Focus Operation Bridge Manager \u591a\u7248\u672c\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u53ef\u80fd\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://softwaresupport.softwaregrp.com/doc/KM03747658",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-64760",
  "openTime": "2020-11-20",
  "patchDescription": "Micro Focus Operation Bridge Manager\u662f\u82f1\u56fdMicro Focus\u516c\u53f8\u7684\u4e00\u6b3e\u4f01\u4e1a\u7ea7\u76d1\u63a7\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u901a\u8fc7HTML5\u6765\u53ef\u89c6\u5316\u603b\u7ed3\u670d\u52a1\u8fd0\u884c\u72b6\u51b5\u3002\r\n\r\nMicro Focus Operation Bridge Manager \u591a\u7248\u672c\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u53ef\u80fd\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Micro Focus Operation Bridge Manager\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Micro Focus Micro Focus Operation Bridge Manager 2020.05",
      "Micro Focus Micro Focus Operation Bridge Manager 2019.11",
      "Micro Focus Micro Focus Operation Bridge Manager 2019.05",
      "Micro Focus Micro Focus Operation Bridge Manager 2018.11",
      "Micro Focus Micro Focus Operation Bridge Manager 2018.05",
      "Micro Focus Micro Focus Operation Bridge Manager 10.6x",
      "Micro Focus Micro Focus Operation Bridge Manager \u003c=10.1x"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-11853",
  "serverity": "\u4e2d",
  "submitTime": "2020-10-25",
  "title": "Micro Focus Operation Bridge Manager\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2020-11853 (GCVE-0-2020-11853)

Vulnerability from cvelistv5 – Published: 2020-10-22 20:37 – Updated: 2024-08-04 11:42

Title

Arbitrary code execution vulnerability on multiple Micro Focus products

Summary

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Arbitrary code execution

Assigner

microfocus

References

URL

Tags

	https://softwaresupport.softwaregrp.com/doc/KM03747658	x_refsource_MISC
	https://softwaresupport.softwaregrp.com/doc/KM03747657	x_refsource_MISC
	https://softwaresupport.softwaregrp.com/doc/KM03747854	x_refsource_MISC
	https://softwaresupport.softwaregrp.com/doc/KM03749879	x_refsource_MISC
	https://softwaresupport.softwaregrp.com/doc/KM03747949	x_refsource_MISC
	https://softwaresupport.softwaregrp.com/doc/KM03747948	x_refsource_MISC
	https://softwaresupport.softwaregrp.com/doc/KM03747950	x_refsource_MISC
	http://packetstormsecurity.com/files/161182/Micro…	x_refsource_MISC
	http://packetstormsecurity.com/files/161366/Micro…	x_refsource_MISC

Impacted products

Vendor

Product

Version

Micro Focus

Operation Bridge Manager

Affected: 2020.5
Affected: 2019.11
Affected: 2019.05
Affected: 2018.11
Affected: 2018.05
Affected: unspecified , ≤ 10.63 (custom)

Micro Focus	Application Performance Management	Affected: 9.51 Affected: 9.50 Affected: 9.40
Micro Focus	Data Center Automation	Affected: 2019.11
Micro Focus	Operations Bridge (containerized)	Affected: 2019.11 Affected: 2019.08 Affected: 2019.05 Affected: 2018.11 Affected: 2018.08 Affected: 2018.05 Affected: 2018.02 Affected: 2017.11
Micro Focus	Universal CMDB	Affected: 2020.05 Affected: 2019.11 Affected: 2019.05 Affected: 2019.02 Affected: 2018.11 Affected: 2018.08 Affected: 2018.05 Affected: 11.0 Affected: 10.33 Affected: 10.32 Affected: 10.31 Affected: 10.30
Micro Focus	Hybrid Cloud Management	Affected: 2018.05 , ≤ 2020.05 (custom)
Micro Focus	Service Management Automation	Affected: 2020.05 Affected: 2020.02

Credits

Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.549Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/doc/KM03747657"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/doc/KM03749879"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/doc/KM03747949"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/doc/KM03747948"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://softwaresupport.softwaregrp.com/doc/KM03747950"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Operation Bridge Manager",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2020.5"
            },
            {
              "status": "affected",
              "version": "2019.11"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "lessThanOrEqual": "10.63",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Application Performance Management",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "9.51"
            },
            {
              "status": "affected",
              "version": "9.50"
            },
            {
              "status": "affected",
              "version": "9.40"
            }
          ]
        },
        {
          "product": "Data Center Automation",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2019.11"
            }
          ]
        },
        {
          "product": "Operations Bridge (containerized)",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2019.11"
            },
            {
              "status": "affected",
              "version": "2019.08"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2018.08"
            },
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "status": "affected",
              "version": "2018.02"
            },
            {
              "status": "affected",
              "version": "2017.11"
            }
          ]
        },
        {
          "product": "Universal CMDB",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2020.05"
            },
            {
              "status": "affected",
              "version": "2019.11"
            },
            {
              "status": "affected",
              "version": "2019.05"
            },
            {
              "status": "affected",
              "version": "2019.02"
            },
            {
              "status": "affected",
              "version": "2018.11"
            },
            {
              "status": "affected",
              "version": "2018.08"
            },
            {
              "status": "affected",
              "version": "2018.05"
            },
            {
              "status": "affected",
              "version": "11.0"
            },
            {
              "status": "affected",
              "version": "10.33"
            },
            {
              "status": "affected",
              "version": "10.32"
            },
            {
              "status": "affected",
              "version": "10.31"
            },
            {
              "status": "affected",
              "version": "10.30"
            }
          ]
        },
        {
          "product": "Hybrid Cloud Management",
          "vendor": "Micro Focus",
          "versions": [
            {
              "lessThanOrEqual": "2020.05",
              "status": "affected",
              "version": "2018.05",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Service Management Automation",
          "vendor": "Micro Focus",
          "versions": [
            {
              "status": "affected",
              "version": "2020.05"
            },
            {
              "status": "affected",
              "version": "2020.02"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Arbitrary code execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-10T16:06:12.000Z",
        "orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
        "shortName": "microfocus"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://softwaresupport.softwaregrp.com/doc/KM03747657"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://softwaresupport.softwaregrp.com/doc/KM03749879"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://softwaresupport.softwaregrp.com/doc/KM03747949"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://softwaresupport.softwaregrp.com/doc/KM03747948"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://softwaresupport.softwaregrp.com/doc/KM03747950"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "For Operation Bridge Manager https://softwaresupport.softwaregrp.com/doc/KM03747658\nFor Application Performance Management https://softwaresupport.softwaregrp.com/doc/KM03747657\nFor Data Center Automation https://softwaresupport.softwaregrp.com/doc/KM03749879\nFor Operation Bridge (containerized) https://softwaresupport.softwaregrp.com/doc/KM03747854\nFor Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03747949\nFor Universal CMDB https://softwaresupport.softwaregrp.com/doc/KM03747948\nFor Service Management Automation https://softwaresupport.softwaregrp.com/doc/KM03747950"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Arbitrary code execution vulnerability on multiple Micro Focus products",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@microfocus.com",
          "ID": "CVE-2020-11853",
          "STATE": "PUBLIC",
          "TITLE": "Arbitrary code execution vulnerability on multiple Micro Focus products"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Operation Bridge Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "2020.5"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2019.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2019.05"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.05"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "10.63"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Application Performance Management",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "9.51"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "9.50"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "9.40"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Data Center Automation",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "2019.11"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Operations Bridge (containerized)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "2019.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2019.08"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2019.05"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.08"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.05"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.02"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2017.11"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Universal CMDB",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "2020.05"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2019.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2019.05"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2019.02"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.08"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2018.05"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.33"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.32"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.31"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.30"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Hybrid Cloud Management",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "2018.05",
                            "version_value": "2020.05"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Service Management Automation",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "2020.05"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "2020.02"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Micro Focus"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "Arbitrary code execution."
          }
        ],
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Arbitrary code execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://softwaresupport.softwaregrp.com/doc/KM03747658",
              "refsource": "MISC",
              "url": "https://softwaresupport.softwaregrp.com/doc/KM03747658"
            },
            {
              "name": "https://softwaresupport.softwaregrp.com/doc/KM03747657",
              "refsource": "MISC",
              "url": "https://softwaresupport.softwaregrp.com/doc/KM03747657"
            },
            {
              "name": "https://softwaresupport.softwaregrp.com/doc/KM03747854",
              "refsource": "MISC",
              "url": "https://softwaresupport.softwaregrp.com/doc/KM03747854"
            },
            {
              "name": "https://softwaresupport.softwaregrp.com/doc/KM03749879",
              "refsource": "MISC",
              "url": "https://softwaresupport.softwaregrp.com/doc/KM03749879"
            },
            {
              "name": "https://softwaresupport.softwaregrp.com/doc/KM03747949",
              "refsource": "MISC",
              "url": "https://softwaresupport.softwaregrp.com/doc/KM03747949"
            },
            {
              "name": "https://softwaresupport.softwaregrp.com/doc/KM03747948",
              "refsource": "MISC",
              "url": "https://softwaresupport.softwaregrp.com/doc/KM03747948"
            },
            {
              "name": "https://softwaresupport.softwaregrp.com/doc/KM03747950",
              "refsource": "MISC",
              "url": "https://softwaresupport.softwaregrp.com/doc/KM03747950"
            },
            {
              "name": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "For Operation Bridge Manager https://softwaresupport.softwaregrp.com/doc/KM03747658\nFor Application Performance Management https://softwaresupport.softwaregrp.com/doc/KM03747657\nFor Data Center Automation https://softwaresupport.softwaregrp.com/doc/KM03749879\nFor Operation Bridge (containerized) https://softwaresupport.softwaregrp.com/doc/KM03747854\nFor Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03747949\nFor Universal CMDB https://softwaresupport.softwaregrp.com/doc/KM03747948\nFor Service Management Automation https://softwaresupport.softwaregrp.com/doc/KM03747950"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
    "assignerShortName": "microfocus",
    "cveId": "CVE-2020-11853",
    "datePublished": "2020-10-22T20:37:51.000Z",
    "dateReserved": "2020-04-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:42:00.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-64760

CVE-2020-11853 (GCVE-0-2020-11853)

Tags

Sightings

Nomenclature