Authorization Bypass Vulnerability in Micro Focus Operation Bridge Reporter
CVE-2020-11857

9.8CRITICAL

Key Information:

Vendor

Microfocus
Status
Operation Bridge Reporter.
Vendor
CVE Published:
22 September 2020

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 65%

What is CVE-2020-11857?

An Authorization Bypass vulnerability exists in Micro Focus Operation Bridge Reporter, impacting version 10.40 and earlier. This flaw can enable remote attackers to gain access to the OBR host, potentially allowing them to operate as non-admin users. By exploiting this vulnerability, unauthorized individuals could access sensitive data and perform unauthorized actions, heightening the risk of data breaches and compromised systems.

Affected Version(s)

Operation Bridge Reporter. 10.40 and earlier.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2020-11857
Created by Rapid7

References

https://softwaresupport.softwaregrp.com/doc/KM03710590
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-20-1215/
x_refsource_MISC
http://packetstormsecurity.com/files/162407/Micro-Focus-O...
x_refsource_MISC

EPSS Score

65% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.