Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Network
0

CVE-2020-11853

Disclosure Date: October 22, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
8.8 High
Impact Score:
5.9
Exploitability Score:
2.8
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • hp,
  • microfocus

Products

  • application performance management 9.40,
  • application performance management 9.50,
  • application performance management 9.51,
  • data center automation,
  • hybrid cloud management,
  • operation bridge manager,
  • operation bridge manager 10.11,
  • operation bridge manager 10.12,
  • operation bridge manager 10.60,
  • operation bridge manager 10.61,
  • operation bridge manager 10.62,
  • operation bridge manager 10.63,
  • operations bridge manager 2017.11,
  • operations bridge manager 2018.02,
  • operations bridge manager 2018.05,
  • operations bridge manager 2018.08,
  • operations bridge manager 2018.11,
  • operations bridge manager 2019.05,
  • operations bridge manager 2019.08,
  • operations bridge manager 2019.11,
  • operations bridge manager 2020.05,
  • service manager automation 2020.02,
  • service manager automation 2020.05,
  • universal cmbd foundation 10.20,
  • universal cmbd foundation 10.30,
  • universal cmbd foundation 10.31,
  • universal cmbd foundation 10.32,
  • universal cmbd foundation 10.33,
  • universal cmbd foundation 11.0,
  • universal cmbd foundation 2018.05,
  • universal cmbd foundation 2018.08,
  • universal cmbd foundation 2018.11,
  • universal cmbd foundation 2019.02,
  • universal cmbd foundation 2019.05,
  • universal cmbd foundation 2019.11,
  • universal cmbd foundation 2020.05.

References

Miscellaneous

Additional Info

Technical Analysis