CVE-2020-11855: 
Operations Bridge Reporter vulnerability analysis and mitigation

An Authorization Bypass vulnerability was identified in Micro Focus Operation Bridge Reporter (OBR), affecting version 10.40 and earlier. The vulnerability, tracked as CVE-2020-11855, was disclosed on September 23, 2020. This security flaw could allow local attackers on the OBR host to execute code with escalated privileges (ZDI Advisory, Micro Focus Advisory).

The vulnerability exists within the product's installer, specifically related to incorrect permissions set on a resource used by the service. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (ZDI Advisory).

An attacker who successfully exploits this vulnerability can leverage it to escalate privileges and execute code in the context of SYSTEM, potentially gaining complete control over the affected system (ZDI Advisory).

The vulnerability requires the attacker to first obtain the ability to execute low-privileged code on the target system. Once this prerequisite is met, the attacker can exploit the incorrect permission assignment to escalate privileges (ZDI Advisory).

Micro Focus has issued an update to correct this vulnerability. Users are advised to apply the latest security patches available through the vendor's support portal (Micro Focus Advisory).