Vulnerability in Micro Focus Application Performance Management
CVE-2020-11854
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.
EPSS: 0.744 (99.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Micro Focus Application Performance Management — versions 9.51, 9.50, 9.40
- Micro Focus Operation Bridge (Containerized) — versions 2020.05, 2019.08, 2019.05
- Micro Focus Operation Bridge Manager — versions 2020.05, 2019.11, 2019.05
- Microfocus Application_performance_management — versions 9.50, 9.51, 9.40
- Microfocus Operations_bridge — versions 2017.11, 2018.02, 2018.05
- Microfocus Operations_bridge_manager — versions 10.11, 10.12, 10.60
- Microfocus Universal_cmdb — versions 10.33
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@opentext.com (x_refsource_MISC)
- security@opentext.com (x_refsource_MISC)
- security@opentext.com (x_refsource_MISC)
- security@opentext.com (x_refsource_MISC)
- security@opentext.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-11854?
- CVE-2020-11854 is a critical-severity vulnerability in Micro Focus Application Performance Management, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2020-10-27.
- How severe is CVE-2020-11854?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2020-11854 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.