CVE-2020-11856: 
Operations Bridge Reporter vulnerability analysis and mitigation

A critical vulnerability (CVE-2020-11856) was identified in Micro Focus Operation Bridge Reporter (OBR) affecting version 10.40 and earlier. This vulnerability allows remote attackers to execute arbitrary code on affected installations without requiring authentication (ZDI Advisory, Micro Focus Advisory).

The vulnerability exists within the configuration of the JMX remote interface. The specific flaw allows a remote attacker to register attacker-controlled MBeans. The vulnerability has received a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating its severe nature. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) (ZDI Advisory, NVD).

An attacker can leverage this vulnerability to execute code in the context of SYSTEM, potentially gaining complete control over the affected system. The vulnerability requires no authentication to exploit, making it particularly dangerous for exposed systems (ZDI Advisory).

The vulnerability is particularly concerning as it requires no authentication to exploit and can be accessed remotely. The attack complexity is rated as low, indicating that it is relatively straightforward to exploit (NVD).

Micro Focus has issued an update to correct this vulnerability. Users are strongly advised to upgrade to a patched version of the software (Micro Focus Advisory).