cve/2020/CVE-2020-11853.md

### [CVE-2020-11853](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11853)
![](https://img.shields.io/static/v1?label=Product&message=Application%20Performance%20Management%20&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Data%20Center%20Automation&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Hybrid%20Cloud%20Management&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Operation%20Bridge%20Manager%20&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Operations%20Bridge%20(containerized)&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Service%20Management%20Automation%20&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Universal%20CMDB%20&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%202019.11%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%202020.05%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%202020.5%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%209.51%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=2018.05%3C%3D%202020.05%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Arbitrary%20code%20execution&color=brighgreen)

### Description

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.

### POC

#### Reference
- http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
- https://github.com/BrittanyKuhn/javascript-tutorial
- https://github.com/Elsfa7-110/kenzer-templates
- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
- https://github.com/Live-Hack-CVE/CVE-2020-11853
- https://github.com/mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet