RCE in Micro Focus Data Center Automation Containerized Suite
CVE-2018-6499
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 201…
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.024 (82.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H.
Affected products
- Micro Focus Data Center Automation Containerized Suite — versions 2017.01 until 2018.05
- Micro Focus Hybrid Cloud Management Containerized Suite — versions HCM2017.11, HCM2018.02, HCM2018.05
- Micro Focus Network Operations Management (Nom) Suite Cdf — versions 2017.11, 2018.02, 2018.05
- Micro Focus Network Virtualization (Nv) With Floating Licenses — versions using Any version using APLS older than 10.7
- Micro Focus Operations Bridge Containerized Suite — versions 2017.11, 2018.02, 2018.05
- Micro Focus Service Management Automation Suite — versions 2017.11, 2018.02, 2018.05
- Micro Focus Service Virtualization (Sv) With Floating Licenses — versions using Any version using APLS older than 10.7
- Micro Focus Unified Functional Testing (Uft) With Floating Licenses — versions using Any version using APLS older than 10.7
- Microfocus Autopass_license_server
- Microfocus Data_center_automation — versions 2017.01, 2017.05, 2017.08
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@opentext.com (x_refsource_CONFIRM)
- security@opentext.com (x_refsource_CONFIRM)
- security@opentext.com (x_refsource_CONFIRM)
- security@opentext.com (x_refsource_CONFIRM)
- security@opentext.com (x_refsource_CONFIRM)
- security@opentext.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2018-6499?
- CVE-2018-6499 is a high-severity vulnerability in Micro Focus Data Center Automation Containerized Suite, classified under Code Injection. CVSS score: 7.1/10. Published 2018-08-30.
- How severe is CVE-2018-6499?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2018-6499 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.