Vulnerability in Micro Focus Application Performance Management

CVE-2020-11854

Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.744 (99.5th percentile), scored .

High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2020-11854: held from 0.744 to 0.744.

EPSS over last 30 days · oldest: 0.744 · newest: 0.744 · change: 0.000

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2020-11854?
CVE-2020-11854 is a critical-severity vulnerability in Micro Focus Application Performance Management, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2020-10-27.
How severe is CVE-2020-11854?
Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-11854 known to be exploited?
6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.