RCE in Micro Focus Data Center Automation Containerized Suite
CVE-2018-6498
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H.
EPSS exploit prediction
EPSS: 0.031 (87.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.031 · newest: 0.031 · change: 0.000
Affected products
- Micro Focus Data Center Automation Containerized Suite — versions 2017.01 until 2018.05
- Micro Focus Hybrid Cloud Management Containerized Suite — versions HCM2017.11, HCM2018.02, HCM2018.05
- Micro Focus Network Operations Management (Nom) Suite Cdf — versions 2017.11, 2018.02, 2018.05
- Micro Focus Operations Bridge Containerized Suite — versions 2017.11, 2018.02, 2018.05
- Micro Focus Service Management Automation Suite — versions 2017.11, 2018.02, 2018.05
- Microfocus Data Center Automation — versions 2017.01, 2017.05, 2017.08
- Microfocus Hybrid Cloud Management — versions 2017.11, 2018.02, 2018.05
- Microfocus Network Operations Management — versions 2017.11, 2018.02, 2018.05
- Microfocus Operations Bridge — versions 2017.11, 2018.02, 2018.05
- Microfocus Service Management Automation — versions 2017.11, 2018.02, 2018.05
Weakness classification (CWE)
Public proof-of-concept exploits
References
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678
Frequently asked questions
- What is CVE-2018-6498?
- CVE-2018-6498 is a high-severity vulnerability in Micro Focus Data Center Automation Containerized Suite, classified under Code Injection. CVSS score: 8.8/10. Published 2018-08-30.
- How severe is CVE-2018-6498?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2018-6498 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.