{"id":"CVE-2020-11853","aliases":["EUVD-2020-4193","GHSA-w38w-pq32-vgxm"],"status":"published","title":"Arbitrary code execution vulnerability on multiple Micro Focus products","description":"Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.7699,"percentile":0.99556,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2020-10-22T20:37:51Z","modified":"2026-06-17T02:50:55Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/microfocus_obm_auth_rce","title":"Micro Focus Operations Bridge Manager Authenticated Remote Code Execution","type":"exploit","platform":"Java","date":"2020-10-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/microfocus_obm_auth_rce"},{"source":"metasploit","id":"exploit/multi/http/microfocus_ucmdb_unauth_deser","title":"Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution","type":"exploit","platform":"Unix,Windows","date":"2020-10-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/microfocus_ucmdb_unauth_deser"},{"source":"nuclei","id":"CVE-2020-11853","title":"Micro Focus Operations Bridge Manager \u003c=2020.05 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11853.yaml"}],"products":[{"vendor":"hp","product":"universal_cmbd_foundation"},{"vendor":"micro focus","product":"application performance management"},{"vendor":"micro focus","product":"data center automation"},{"vendor":"micro focus","product":"hybrid cloud management"},{"vendor":"micro focus","product":"operation bridge manager"},{"vendor":"micro focus","product":"operations bridge (containerized)"},{"vendor":"micro focus","product":"service management automation"},{"vendor":"micro focus","product":"universal cmdb"},{"vendor":"microfocus","product":"application_performance_management"},{"vendor":"microfocus","product":"data_center_automation"},{"vendor":"microfocus","product":"hybrid_cloud_management"},{"vendor":"microfocus","product":"operation_bridge_manager"},{"vendor":"microfocus","product":"operations_bridge_manager"},{"vendor":"microfocus","product":"service_manager_automation"}],"references":[{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747658","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747657","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747854","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03749879","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747949","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747948","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747950","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11853"},{"url":"https://github.com/advisories/GHSA-w38w-pq32-vgxm"}],"sources":{"cve":[{"id":"CVE-2020-11853","title":"Arbitrary code execution vulnerability on multiple Micro Focus products","description":"Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.","status":"published","published":"2020-10-22T20:37:51Z","modified":"2024-08-04T11:42:00.549Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-4193","description":"Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.","status":"published","published":"2020-10-22T20:37:51Z","modified":"2024-08-04T11:42:00Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:07:41.956166Z"}],"ghsa":[{"id":"GHSA-w38w-pq32-vgxm","title":"An arbitrary code execution vulnerability exists in Micro Focus Operation Bridge Manager 2020.05,...","description":"An arbitrary code execution vulnerability exists in Micro Focus Operation Bridge Manager 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. The vulnerability could allow remote attackers to execute arbitrary code.","status":"published","published":"2022-05-24T17:31:56Z","modified":"2023-01-28T05:02:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:43:51.685777Z"}],"nvd":[{"id":"CVE-2020-11853","description":"Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.","status":"published","published":"2020-10-22T21:15:12.747Z","modified":"2026-06-17T02:50:55.007Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:20.704992Z"}]}}