Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.

Vulnerability

The vulnerability resides in the authentication mechanism of Micro Focus Operations Bridge Manager (OBM), Operations Bridge (containerized), and Application Performance Management (APM) products. The affected versions include OBM versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63, 10.62, 10.61, 10.60, 10.12, 10.11, 10.10, and all earlier versions; Operations Bridge (containerized) versions 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, and 2017.11; and APM versions 9.51, 9.50, and 9.40 with uCMDB 10.33 CUP 3 [1][2][3]. The flaw involves the use of a hard-coded password for a diagnostics user account, allowing arbitrary code execution through network access [4].

Exploitation

An attacker can exploit this vulnerability remotely without any authentication or user interaction. The attack requires network access to the OBM application [1][2][3]. The specific flaw is the presence of a hard-coded password for the diagnostics user account; an attacker leverages this account to gain access [4]. No additional privileges or special conditions are necessary beyond network connectivity to the affected service.

Impact

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code in the context of SYSTEM on the affected host [4]. This results in full compromise of confidentiality, integrity, and availability (CIA) of the system. The CVSS v3 base score for this vulnerability is 9.8 (Critical), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [4].

Mitigation

Micro Focus has released security patches for the affected products. For Operations Bridge (containerized), refer to document KM03747854 [1]; for Operation Bridge Manager, refer to KM03747658 [2]; and for Application Performance Management, refer to KM03747657 [3]. Users should apply the latest fixed versions as indicated in the respective advisories. No workarounds are documented in the available references. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.