RCE in Micro Focus Data Center Automation Containerized Suite
CVE-2018-6499
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H.
EPSS exploit prediction
EPSS: 0.024 (83.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 83.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.024 · newest: 0.024 · change: 0.000
Affected products
- Micro Focus Data Center Automation Containerized Suite — versions 2017.01 until 2018.05
- Micro Focus Hybrid Cloud Management Containerized Suite — versions HCM2017.11, HCM2018.02, HCM2018.05
- Micro Focus Network Operations Management (Nom) Suite Cdf — versions 2017.11, 2018.02, 2018.05
- Micro Focus Network Virtualization (Nv) With Floating Licenses — versions using Any version using APLS older than 10.7
- Micro Focus Operations Bridge Containerized Suite — versions 2017.11, 2018.02, 2018.05
- Micro Focus Service Management Automation Suite — versions 2017.11, 2018.02, 2018.05
- Micro Focus Service Virtualization (Sv) With Floating Licenses — versions using Any version using APLS older than 10.7
- Micro Focus Unified Functional Testing (Uft) With Floating Licenses — versions using Any version using APLS older than 10.7
- Microfocus Autopass License Server
- Microfocus Data Center Automation — versions 2017.01, 2017.05, 2017.08
Weakness classification (CWE)
Public proof-of-concept exploits
References
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632
- softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726
Frequently asked questions
- What is CVE-2018-6499?
- CVE-2018-6499 is a high-severity vulnerability in Micro Focus Data Center Automation Containerized Suite, classified under Code Injection. CVSS score: 7.1/10. Published 2018-08-30.
- How severe is CVE-2018-6499?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2018-6499 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.