CVE-2020-11857: 
Operations Bridge Reporter vulnerability analysis and mitigation

An Authorization Bypass vulnerability (CVE-2020-11857) was discovered in Micro Focus Operation Bridge Reporter (OBR), affecting version 10.40 and earlier. The vulnerability was disclosed on September 22, 2020, and allows remote attackers to access the OBR host as a non-admin user (NVD, ZDI Advisory).

The vulnerability is related to the creation of the shrboadmin user during installation, where the product contains a hard-coded password for this account. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness has been categorized as CWE-798 (Use of Hard-coded Credentials) (ZDI Advisory, NVD).

The vulnerability allows remote attackers to access the OBR host with non-administrative privileges. An attacker can leverage this vulnerability to execute arbitrary code in the context of the shrboadmin user, potentially compromising the security of the affected system (ZDI Advisory, Micro Focus Advisory).

The vulnerability requires no authentication to exploit, making it highly exploitable. The attack can be performed remotely, with low attack complexity, and requires no user interaction (NVD).

Micro Focus has issued an update to correct this vulnerability. Users are advised to apply the security update as detailed in the vendor advisory (Micro Focus Advisory).