Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products.

Vulnerability

CVE-2020-11858 is an improper permission assignment vulnerability in the Micro Focus Operations Bridge Manager (OBM) and Operations Bridge (containerized) products. The flaw resides in the product installer, which sets incorrect permissions on the installation directory. Affected versions include Operations Bridge Manager 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63, 10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions, as well as Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, and 2017.11. The vulnerability is only exploitable when the Operations Bridge Manager capability is deployed in the containerized version. [1], [2], [3]

Exploitation

An attacker must first obtain the ability to execute low-privileged code on the target OBM host system. No network access, authentication to the OBM application, or user interaction is required beyond the initial low-privilege code execution. The specific flaw is the incorrect permission set on the installation directory, which allows the attacker to write or modify files that are executed with higher privileges. The attacker then leverages these misconfigured permissions to escalate privileges and execute arbitrary code in the context of SYSTEM. [3]

Impact

Successful exploitation allows a local attacker to execute arbitrary code with escalated privileges, specifically gaining full SYSTEM-level control on the host. This provides a complete compromise of the confidentiality, integrity, and availability of the affected system, as the attacker can read, modify, or disrupt any data or processes on the host. [1], [2], [3]

Mitigation

Micro Focus has released security patches for both product lines. For Operations Bridge Manager, the fixed versions are 2020.05 (update), 2019.11 (update), 2019.05 (update), 2018.11 (update), and 2018.05 (update) — specific patch details are available from Micro Focus support (KM03747658). For Operations Bridge (containerized), fixed versions are 2020.05 (update), 2019.08 (update), and 2019.05 (update) — refer to KM03747854. If patching is not immediately possible, restrict local access to the OBM host to trusted administrators only. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities catalog as of publication. [1], [2]