CVE-2020-11853

Description

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.

CVSS breakdown

Affected products

• Micro Focus / Application Performance Management9.50 – 9.50
• Micro Focus / Application Performance Management9.40 – 9.40
• Micro Focus / Application Performance Management9.51 – 9.51
• Micro Focus / Data Center Automation2019.11 – 2019.11
• Micro Focus / Hybrid Cloud Management2018.05 – 2020.05
• Micro Focus / Operation Bridge Manager2019.05 – 2019.05
• Micro Focus / Operation Bridge Manager2019.11 – 2019.11
• Micro Focus / Operation Bridge Manager2018.11 – 2018.11
• Micro Focus / Operation Bridge Manager2018.05 – 2018.05
• Micro Focus / Operation Bridge Managerunspecified – 10.63
• Micro Focus / Operation Bridge Manager2020.5 – 2020.5
• Micro Focus / Operations Bridge (containerized)2018.02 – 2018.02
• Micro Focus / Operations Bridge (containerized)2019.11 – 2019.11
• Micro Focus / Operations Bridge (containerized)2019.08 – 2019.08
• Micro Focus / Operations Bridge (containerized)2019.05 – 2019.05
• Micro Focus / Operations Bridge (containerized)2018.11 – 2018.11
• Micro Focus / Operations Bridge (containerized)2018.08 – 2018.08
• Micro Focus / Operations Bridge (containerized)2018.05 – 2018.05
• Micro Focus / Operations Bridge (containerized)2017.11 – 2017.11
• Micro Focus / Service Management Automation2020.05 – 2020.05
• Micro Focus / Service Management Automation2020.02 – 2020.02
• Micro Focus / Universal CMDB2019.02 – 2019.02
• Micro Focus / Universal CMDB2018.11 – 2018.11
• Micro Focus / Universal CMDB2018.08 – 2018.08
• Micro Focus / Universal CMDB2018.05 – 2018.05
• Micro Focus / Universal CMDB11.0 – 11.0
• Micro Focus / Universal CMDB2019.11 – 2019.11
• Micro Focus / Universal CMDB10.32 – 10.32
• Micro Focus / Universal CMDB10.31 – 10.31
• Micro Focus / Universal CMDB10.30 – 10.30
• Micro Focus / Universal CMDB2020.05 – 2020.05
• Micro Focus / Universal CMDB10.33 – 10.33
• Micro Focus / Universal CMDB2019.05 – 2019.05

Exploits & PoCs

• nucleiMicro Focus Checksby dwisiswant0
• nucleiMicro Focus Universal CMDB Default Loginby dwisiswant0
• nucleiMicro Focus Operations Bridge Manager <=2020.05 - Remote Code Executionby dwisiswant0

References

• MISChttps://softwaresupport.softwaregrp.com/doc/KM03747658
• MISChttps://softwaresupport.softwaregrp.com/doc/KM03747657
• MISChttps://softwaresupport.softwaregrp.com/doc/KM03747854
• MISChttps://softwaresupport.softwaregrp.com/doc/KM03749879
• MISChttps://softwaresupport.softwaregrp.com/doc/KM03747949
• MISChttps://softwaresupport.softwaregrp.com/doc/KM03747948
• MISChttps://softwaresupport.softwaregrp.com/doc/KM03747950
• EXPLOIThttp://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html
• EXPLOIThttp://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html