{"id":"CVE-2020-11853","published":"2020-10-22T20:37:51Z","modified":"2024-08-04T11:42:00Z","title":"Arbitrary code execution vulnerability on multiple Micro Focus products","vendor":"Micro Focus","product":"Operation Bridge Manager","tier":"core","eol":null,"affectedVersions":[{"vendor":"Micro Focus","product":"Operation Bridge Manager","versions":["2020.5","2019.11","2019.05","2018.11","2018.05",">= unspecified, <= 10.63"]},{"vendor":"Micro Focus","product":"Application Performance Management","versions":["9.51","9.50","9.40"]},{"vendor":"Micro Focus","product":"Data Center Automation","versions":["2019.11"]},{"vendor":"Micro Focus","product":"Operations Bridge (containerized)","versions":["2019.11","2019.08","2019.05","2018.11","2018.08","2018.05","2018.02","2017.11"]},{"vendor":"Micro Focus","product":"Universal CMDB","versions":["2020.05","2019.11","2019.05","2019.02","2018.11","2018.08","2018.05","11.0","10.33","10.32"]},{"vendor":"Micro Focus","product":"Hybrid Cloud Management","versions":[">= 2018.05, <= 2020.05"]},{"vendor":"Micro Focus","product":"Service Management Automation","versions":["2020.05","2020.02"]}],"description":{"text":"Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an arbitrary code execution vulnerability in several Micro Focus products, including Operation Bridge Manager, Application Performance Management, Data Center Automation, Operations Bridge (containerized), Universal CMDB, Hybrid Cloud Management, and Service Management Automation. An attacker who can reach the affected product over the network, with low-privilege authentication and no user interaction, could execute arbitrary code on the system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:00Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.7699,"percentile":0.99548,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747658","tags":["x_refsource_MISC"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747657","tags":["x_refsource_MISC"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747854","tags":["x_refsource_MISC"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03749879","tags":["x_refsource_MISC"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747949","tags":["x_refsource_MISC"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747948","tags":["x_refsource_MISC"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747950","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-4193","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-4193","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Micro Focus Operations Bridge Manager Authenticated Remote Code Execution","module":"exploit/multi/http/microfocus_obm_auth_rce","type":"exploit","disclosureDate":"2020-10-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_obm_auth_rce.rb"},{"name":"Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution","module":"exploit/multi/http/microfocus_ucmdb_unauth_deser","type":"exploit","disclosureDate":"2020-10-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb"}],"nuclei":[{"id":"CVE-2020-11853","name":"Micro Focus Operations Bridge Manager <=2020.05 - Remote Code Execution","severity":"high","path":"http/cves/2020/CVE-2020-11853.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11853.yaml"}],"first":{"date":"2020-10-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_obm_auth_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html","http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2020-10-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-11853","provenance":"source"},{"date":"2020-10-28","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_obm_auth_rce.rb","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9955"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD exploit links; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}