CVE-2022-38754: CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-08 · updated 2026-06-17
Weakness: CWE-79

Description

A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.

Affected products

Operations Bridge containerized.: before 2022.11 — fixed in 2022.11
Operations Bridge Manager.: before 2022.11 — fixed in 2022.11

How to fix

Upgrade to a fixed version: Operations Bridge containerized. 2022.11; Operations Bridge Manager. 2022.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-38754 or the next vulnerability affects your stack