Lucene search

[email protected]CVE-2020-11858

HistoryOct 27, 2020 - 5:15 p.m.

CVE-2020-11858

2020-10-2717:15:12

[email protected]

web.nvd.nist.gov

cve

2020

11858

code execution

vulnerability

micro focus

operation bridge manager

operation bridge

escalated privileges

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.0%

JSON

Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges.

Affected configurations

NVD

Node

microfocusoperations_bridgeMatch2017.11

microfocusoperations_bridgeMatch2018.02

microfocusoperations_bridgeMatch2018.05

microfocusoperations_bridgeMatch2018.08

microfocusoperations_bridgeMatch2018.11

microfocusoperations_bridgeMatch2019.05

microfocusoperations_bridgeMatch2019.08

microfocusoperations_bridgeMatch2020.05

microfocusoperations_bridge_managerRange≤10.10

microfocusoperations_bridge_managerMatch10.11

microfocusoperations_bridge_managerMatch10.12

microfocusoperations_bridge_managerMatch10.60

microfocusoperations_bridge_managerMatch10.61

microfocusoperations_bridge_managerMatch10.62

microfocusoperations_bridge_managerMatch10.63

microfocusoperations_bridge_managerMatch2018.05

microfocusoperations_bridge_managerMatch2018.11

microfocusoperations_bridge_managerMatch2019.05

microfocusoperations_bridge_managerMatch2019.11

microfocusoperations_bridge_managerMatch2020.05

CPENameOperatorVersion
microfocus:operations_bridgemicrofocus operations bridgeeq2017.11
microfocus:operations_bridgemicrofocus operations bridgeeq2018.02
microfocus:operations_bridgemicrofocus operations bridgeeq2018.05
microfocus:operations_bridgemicrofocus operations bridgeeq2018.08
microfocus:operations_bridgemicrofocus operations bridgeeq2018.11
microfocus:operations_bridgemicrofocus operations bridgeeq2019.05
microfocus:operations_bridgemicrofocus operations bridgeeq2019.08
microfocus:operations_bridgemicrofocus operations bridgeeq2020.05
microfocus:operations_bridge_managermicrofocus operations bridge managerle10.10
microfocus:operations_bridge_managermicrofocus operations bridge managereq10.11

CPE	Name	Operator	Version
microfocus:operations_bridge	microfocus operations bridge	eq	2017.11
microfocus:operations_bridge	microfocus operations bridge	eq	2018.02
microfocus:operations_bridge	microfocus operations bridge	eq	2018.05
microfocus:operations_bridge	microfocus operations bridge	eq	2018.08
microfocus:operations_bridge	microfocus operations bridge	eq	2018.11
microfocus:operations_bridge	microfocus operations bridge	eq	2019.05
microfocus:operations_bridge	microfocus operations bridge	eq	2019.08
microfocus:operations_bridge	microfocus operations bridge	eq	2020.05
microfocus:operations_bridge_manager	microfocus operations bridge manager	le	10.10
microfocus:operations_bridge_manager	microfocus operations bridge manager	eq	10.11

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "product": "Operation Bridge (containerized)",
    "vendor": "Micro Focus ",
    "versions": [
      {
        "status": "affected",
        "version": "2020.05"
      },
      {
        "status": "affected",
        "version": "2019.08"
      },
      {
        "status": "affected",
        "version": "2019.05"
      },
      {
        "status": "affected",
        "version": "2018.11"
      },
      {
        "status": "affected",
        "version": "2018.08"
      },
      {
        "status": "affected",
        "version": "2018.05"
      },
      {
        "status": "affected",
        "version": "2018.02"
      },
      {
        "status": "affected",
        "version": "2017.11"
      }
    ]
  },
  {
    "product": "Operation Bridge Manager",
    "vendor": "Micro Focus ",
    "versions": [
      {
        "status": "affected",
        "version": "2020.05"
      },
      {
        "status": "affected",
        "version": "2019.11"
      },
      {
        "status": "affected",
        "version": "2019.05"
      },
      {
        "status": "affected",
        "version": "2018.11"
      },
      {
        "status": "affected",
        "version": "2018.05"
      },
      {
        "status": "affected",
        "version": "10.63"
      },
      {
        "status": "affected",
        "version": "10.62"
      },
      {
        "status": "affected",
        "version": "10.61"
      },
      {
        "status": "affected",
        "version": "10.60"
      },
      {
        "status": "affected",
        "version": "10.12"
      },
      {
        "status": "affected",
        "version": "10.11"
      },
      {
        "lessThanOrEqual": "10.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html

softwaresupport.softwaregrp.com/doc/KM03747658

softwaresupport.softwaregrp.com/doc/KM03747854

www.zerodayinitiative.com/advisories/ZDI-20-1326/

Social References

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.0%

JSON

Related for CVE-2020-11858

cvelist1 prion1 zdt1 packetstorm1 nvd1 zdi1 rapid7blog1