title: Arbitrary code execution vulnerability on multiple Micro Focus products
description: Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.
problem types: Arbitrary code execution
affected:
{
product: Operation Bridge Manager
vendor: Micro Focus
versions:
status: affected, version: 2020.5
status: affected, version: 2019.11
status: affected, version: 2019.05
status: affected, version: 2018.11
status: affected, version: 2018.05
lessThanOrEqual: 10.63, status: affected, version: unspecified, versionType: custom
}
{
product: Application Performance Management
vendor: Micro Focus
versions:
status: affected, version: 9.51
status: affected, version: 9.50
status: affected, version: 9.40
}
{
product: Data Center Automation
vendor: Micro Focus
versions:
status: affected, version: 2019.11
}
{
product: Operations Bridge (containerized)
vendor: Micro Focus
versions:
status: affected, version: 2019.11
status: affected, version: 2019.08
status: affected, version: 2019.05
status: affected, version: 2018.11
status: affected, version: 2018.08
status: affected, version: 2018.05
status: affected, version: 2018.02
status: affected, version: 2017.11
}
{
product: Universal CMDB
vendor: Micro Focus
versions:
status: affected, version: 2020.05
status: affected, version: 2019.11
status: affected, version: 2019.05
status: affected, version: 2019.02
status: affected, version: 2018.11
status: affected, version: 2018.08
status: affected, version: 2018.05
status: affected, version: 11.0
status: affected, version: 10.33
status: affected, version: 10.32
status: affected, version: 10.31
status: affected, version: 10.30
}
{
product: Hybrid Cloud Management
vendor: Micro Focus
versions:
lessThanOrEqual: 2020.05, status: affected, version: 2018.05, versionType: custom
}
{
product: Service Management Automation
vendor: Micro Focus
versions:
status: affected, version: 2020.05
status: affected, version: 2020.02
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
exploits: Arbitrary code execution.
solutions: For Operation Bridge Manager https://softwaresupport.softwaregrp.com/doc/KM03747658
For Application Performance Management https://softwaresupport.softwaregrp.com/doc/KM03747657
For Data Center Automation https://softwaresupport.softwaregrp.com/doc/KM03749879
For Operation Bridge (containerized) https://softwaresupport.softwaregrp.com/doc/KM03747854
For Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03747949
For Universal CMDB https://softwaresupport.softwaregrp.com/doc/KM03747948
For Service Management Automation https://softwaresupport.softwaregrp.com/doc/KM03747950