CVE-2020-11853 in the critical feed json
Arbitrary code execution vulnerability on multiple Micro Focus products
published 2020-10-22 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4193
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 77.0%
- EPSS 77.0% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 2
- Metasploit, plus a Nuclei check
Summary
Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.
Timeline
- Published
- First public exploit (Metasploit exploit/multi/http/microfocus_obm_auth_rce)
Exploit prediction
76.99% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/microfocus_obm_auth_rce Micro Focus Operations Bridge Manager Authenticated Remote Code Execution metasploit exploit, excellent rank, 2020-10-28
- Metasploit exploit/multi/http/microfocus_ucmdb_unauth_deser Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution metasploit exploit, excellent rank, 2020-10-28
- Nuclei template Micro Focus Operations Bridge Manager <=2020.05 - Remote Code Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- Micro Focus Operation Bridge Manager
- Micro Focus Application Performance Management
- Micro Focus Data Center Automation
- Micro Focus Operations Bridge (containerized)
- Micro Focus Universal CMDB
- Micro Focus Hybrid Cloud Management
- Micro Focus Service Management Automation
References
- softwaresupport.softwaregrp.com /doc/KM03747658
- softwaresupport.softwaregrp.com /doc/KM03747657
- softwaresupport.softwaregrp.com /doc/KM03747854
- softwaresupport.softwaregrp.com /doc/KM03749879
- softwaresupport.softwaregrp.com /doc/KM03747949
- softwaresupport.softwaregrp.com /doc/KM03747948
- softwaresupport.softwaregrp.com /doc/KM03747950
- packetstormsecurity.com /files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html
- packetstormsecurity.com /files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html
Sources
- CVE List CVE-2020-11853
- NVD CVE-2020-11853
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.