PT-2020-12900 · Micro Focus · Operation Bridge Manager+1

Pedrib1337 + 1 · Published 2020-10-27 · Updated 2022-11-16 · CVE-2020-11858

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Operation Bridge Manager versions 10.10 through 2020.05 Operations Bridge (containerized) versions 2017.11 through 2020.05

Description The issue affects Micro Focus products, allowing local attackers to execute code with escalated privileges. This could enable attackers to perform actions with higher privileges than intended.

Recommendations For Operation Bridge Manager versions 10.10 through 2020.05, update to a version later than 2020.05 to resolve the issue. For Operations Bridge (containerized) versions 2017.11 through 2020.05, update to a version later than 2020.05 to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2020-11858

ZDI-20-1326

Affected Products

Operation Bridge Manager

Operations Bridge

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/microfocus_operations_privesc.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-11858 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-1326 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-11858 · Security Note
• https://softwaresupport.softwaregrp.com/doc/KM03747854 · Note
• https://t.me/cibsecurity/15620 · Telegram Post
• https://softwaresupport.softwaregrp.com/doc/KM03747658 · Note