{"id":"CVE-2020-11854","published":"2020-10-27T16:29:44Z","modified":"2024-08-04T11:42:00Z","title":"Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations…","vendor":"Micro Focus","product":"Application Performance Management","tier":"core","eol":null,"affectedVersions":[{"vendor":"Micro Focus","product":"Application Performance Management","versions":["9.51","9.50","9.40"]},{"vendor":"Micro Focus","product":"Operation Bridge (containerized)","versions":["2020.05","2019.08","2019.05","2018.11","2018.08","2018.05","2018.02","2017.11"]},{"vendor":"Micro Focus","product":"Operation Bridge Manager","versions":["2020.05","2019.11","2019.05","2018.11","2018.05","10.63","10.62","10.61","10.60","10.12"]}],"description":{"text":"Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an arbitrary code execution vulnerability in Micro Focus's Application Performance Management, affecting its Operation Bridge Manager, Operation Bridge (containerized), and Application Performance Management products. An attacker with network access and no authentication or user interaction could exploit it to execute arbitrary code on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:58Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.74449,"percentile":0.99493,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-01-13","exploitedFirstSeen":"2024-01-13","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-13&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-26&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-29&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-31&host_type=src&vulnerability=cve-2020-11854","date":"2024-01-31"}],"evidenceTotal":326,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747658","tags":["x_refsource_MISC"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747657","tags":["x_refsource_MISC"]},{"url":"https://softwaresupport.softwaregrp.com/doc/KM03747854","tags":["x_refsource_MISC"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1287/","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-4194","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-4194","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution","module":"exploit/multi/http/microfocus_ucmdb_unauth_deser","type":"exploit","disclosureDate":"2020-10-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb"}],"nuclei":[{"id":"CVE-2020-11854","name":"Micro Focus UCMDB - Remote Code Execution","severity":"critical","path":"http/cves/2020/CVE-2020-11854.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11854.yaml"}],"first":{"date":"2020-10-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2020-10-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-11854","provenance":"source"},{"date":"2020-10-28","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/microfocus_ucmdb_unauth_deser.rb","provenance":"source"},{"date":"2024-01-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-13&host_type=src&vulnerability=cve-2020-11854","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1023 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9949"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}