CVE-2020-11853Arbitrary code execution vulnerability on multiple Micro Focus products
- 8.8HighCVSS base score
- 77.0%Exploitation in 30 daysEPSS · top 0.4% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 3Public exploitsMetasploit, Nuclei and Exploit-DB
Description
Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list 2 Metasploit modules and a Nuclei template for it.
Show the exploits3
Metasploit modules2 modules
- Micro Focus Operations Bridge Manager Authenticated Remote Code Execution (Metasploit module) (opens in a new tab)
exploit/multi/http/microfocus_obm_auth_rceRank excellentdisclosed 28 Oct 2020
- Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution (Metasploit module) (opens in a new tab)
exploit/multi/http/microfocus_ucmdb_unauth_deserRank excellentdisclosed 28 Oct 2020
Nuclei templates1 template
- Micro Focus Operations Bridge Manager <=2020.05 - Remote Code Execution (Nuclei template) (opens in a new tab)
http/cves/2020/CVE-2020-11853.yamlSeverity high
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By microfocus
- 6 months later
· 6 months later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| microfocusCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 77.0% · top 0.4% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
Micro Focus · Operation Bridge Manager
- affected 2020.5
- affected 2019.11
- affected 2019.05
- affected 2018.11
- affected 2018.05
- affected unspecified – ≤ 10.63
Micro Focus · Application Performance Management
- affected 9.51
- affected 9.50
- affected 9.40
Micro Focus · Data Center Automation
- affected 2019.11
Micro Focus · Operations Bridge (containerized)
- affected 2019.11
- affected 2019.08
- affected 2019.05
- affected 2018.11
- affected 2018.08
- affected 2018.05
- affected 2018.02
- affected 2017.11
- affected 2020.05
- affected 2019.11
- affected 2019.05
- affected 2019.02
- affected 2018.11
- affected 2018.08
- affected 2018.05
- affected 11.0
- affected 10.33
- affected 10.32
- affected 10.31
- affected 10.30
Micro Focus · Hybrid Cloud Management
- affected 2018.05 – ≤ 2020.05
Micro Focus · Service Management Automation
- affected 2020.05
- affected 2020.02
What to do
Solution: For Operation Bridge Manager https://softwaresupport.softwaregrp.com/doc/KM03747658 For Application Performance Management https://softwaresupport.softwaregrp.com/doc/KM03747657 For Data Center Automation https://softwaresupport.softwaregrp.com/doc/KM03749879 For Operation Bridge (containerized) https://softwaresupport.softwaregrp.com/doc/KM03747854 For Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03747949 For Universal CMDB https://softwaresupport.softwaregrp.com/doc/KM03747948 For Service Management Automation https://softwaresupport.softwaregrp.com/doc/KM03747950
Exploitation: Arbitrary code execution.
References
References9
- https://softwaresupport.softwaregrp.com/doc/KM03747658 (opens in a new tab)x_refsource_MISCx_transferred
- https://softwaresupport.softwaregrp.com/doc/KM03747657 (opens in a new tab)x_refsource_MISCx_transferred
- https://softwaresupport.softwaregrp.com/doc/KM03747854 (opens in a new tab)x_refsource_MISCx_transferred
- https://softwaresupport.softwaregrp.com/doc/KM03749879 (opens in a new tab)x_refsource_MISCx_transferred
- https://softwaresupport.softwaregrp.com/doc/KM03747949 (opens in a new tab)x_refsource_MISCx_transferred
- https://softwaresupport.softwaregrp.com/doc/KM03747948 (opens in a new tab)x_refsource_MISCx_transferred
- https://softwaresupport.softwaregrp.com/doc/KM03747950 (opens in a new tab)x_refsource_MISCx_transferred
- http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html (opens in a new tab)x_refsource_MISCx_transferred
- http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2020-4193 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2020-11853)Record last updated .