Critical severity · published Aug 30, 2018
CVE-2018-6499
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11,…
9.8
CVSS
2.4%
EPSS
No
On KEV
Description
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Data Center Automation · Microfocus
2017.01; 2017.05; 2017.08; 2017.09; 2017.11; 2018.02; +1 more · source: NVD
HC
Hybrid Cloud Management · Microfocus
2017.11; 2017.11; 2018.02; 2018.02; 2018.05; 2018.05 · source: NVD
NO
Network Operations Management · Microfocus
2017.11; 2018.02; 2018.05 · source: NVD
NV
Network Virtualization · Microfocus
12.50 · source: NVD
OB
Operations Bridge · Microfocus
2017.11; 2018.02; 2018.05 · source: NVD
SM
Service Management Automation · Microfocus
2017.11; 2018.02; 2018.05 · source: NVD
SV
Service Virtualization · Microfocus
1.00 · source: NVD
UF
Unified Functional Testing · Microfocus
12.50 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6499
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en&cc=us&hpappid=206728_SSO_PRO
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726
More from Data Center Automation
9.8
CVE-2018-6498
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11,…
8.8
CVE-2020-11853
Arbitrary code execution vulnerability affecting multiple Micro Focus products