Lucene search

K
zdiPedro Ribeiro ([email protected]|@pedrib1337) from Agile Information SecurityZDI-20-1216
HistorySep 23, 2020 - 12:00 a.m.

Micro Focus Operations Bridge Reporter JMX Missing Authentication Remote Code Execution Vulnerability

2020-09-2300:00:00
Pedro Ribeiro ([email protected]|@pedrib1337) from Agile Information Security
www.zerodayinitiative.com
15
micro focus
operations bridge reporter
jmx
missing authentication
remote code execution
vulnerability
configuration
remote interface
mbeans
system.

EPSS

0.11

Percentile

95.2%

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Micro Focus Operations Bridge Reporter. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the JMX remote interface. This interface allows a remote attacker to register attacker-controlled MBeans. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.

EPSS

0.11

Percentile

95.2%

Related for ZDI-20-1216