CVE-2020-11855: Micro Focus Operations Bridge Reporter HPE-OBR Incorrect Permission Assignment Privilege Escalation Vulnerability
First published: Tue Sep 22 2020(Updated: )
This vulnerability allows local attackers to escalate privileges on affected installations of Micro Focus Operations Bridge Reporter. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the product's installer. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM.
Credit: security@microfocus.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Micro Focus Operations Bridge Reporter | ||
| Microfocus Operation Bridge Reporter | <=10.40 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2020-11855.
What is the severity of CVE-2020-11855?
The severity of CVE-2020-11855 is high with a CVSS score of 8.4.
What software is affected by CVE-2020-11855?
Micro Focus Operations Bridge Reporter versions up to and including 10.40 are affected by CVE-2020-11855.
How can an attacker exploit CVE-2020-11855?
An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit CVE-2020-11855.
Are there any references for CVE-2020-11855?
Yes, you can find more information about CVE-2020-11855 at the following references: [Reference 1](https://softwaresupport.softwaregrp.com/doc/KM03710590) and [Reference 2](https://www.zerodayinitiative.com/advisories/ZDI-20-1217/).
- collector/zdi-advisory
- alias/ZDI-20-1217
- alias/ZDI-CAN-11073
- alias/CVE-2020-11855
- collector/nvd-index
- vendor/micro focus
- canonical/micro focus operations bridge reporter
- vendor/microfocus
- canonical/microfocus operation bridge reporter
- version/microfocus operation bridge reporter/10.40