CVE-2018-6499
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedRemote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceThis is a Remote Code Execution (RCE) vulnerability in HPE/Micro Focus license management components (APLS - Application License Service) affecting multiple containerized management suites and products with floating licenses. The vulnerability is exploitable remotely without authentication, allowing attackers to execute arbitrary code on affected systems.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 2017.01= 2017.05= 2017.08= 2017.09= 2017.11= 2018.02= 2018.05= 2017.11= 2018.02= 2018.05= 2017.11= 2018.02= 2018.05= 2017.11= 2018.02= 2018.05= 2017.11= 2018.02= 2018.05= 12.50= 1.00= 12.50CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify running APLS processesOn Linux, run 'ps aux | grep -i apls' or 'ps aux | grep -i "Application License"'. On Windows, check running services for 'APLS' or 'Application License Service' via Task Manager or 'sc query' command.Affected if APLS process or service is running and its version is below 10.7, or the version cannot be determined.
-
Check APLS version numberIf APLS is running, find its version. Common locations: Linux '/opt/mf/apls/bin' or similar paths; Windows check registry under 'HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Micro Focus\APLS' or the service properties. Also check product-specific documentation for version lookup commands.Affected if The installed APLS version is 10.6 or earlier, or any version prior to 10.7, matching one of the affected product bundles listed in the CVE.
-
Identify installed Micro Focus productsList installed software on the system. Linux: check package manager 'rpm -qa | grep -i micro' or 'dpkg -l | grep -i micro'. Windows: check Add/Remove Programs or 'wmic product get name,version' for Data Center Automation, Hybrid Cloud Management, Network Operations Management, Operations Bridge, Service Management Automation, Network Virtualization, Service Virtualization, or Unified Functional Testing.Affected if Any of the affected products are installed with versions 2017.01 through 2018.05, Network Virtualization 12.50, Service Virtualization 1.00, or Unified Functional Testing 12.50.
-
Check for exposed APLS network listenersRun 'netstat -an | grep -E "(5814|5815|5816|7000|7001|27000)"' or similar license manager ports, and 'nmap -p 5814,5815,5816,7000,7001,27000 <your-ip>' to identify listening ports. Check firewall rules and exposed network services.Affected if The APLS service ports are open and accessible from network locations other than localhost, indicating remote exploit potential.
-
Verify floating license configurationCheck license configuration files in the product directories for floating license server settings. Look for files like 'license.dat', 'lmgrd.conf', or vendor-specific license configuration that references APLS as the license server.Affected if Floating licenses are configured to use an APLS server that is the vulnerable component.
A system is likely affected if any of the listed Micro Focus products (versions 2017.01-2018.05 for suites, 12.50/1.00 for others) are installed with an APLS version below 10.7, and the APLS service is network-accessible.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataApply vendor-supplied patches to APLS version 10.7 or later, or upgrade to patched versions of the affected containerized suites. If immediate patching is not possible, restrict network access to license management ports and monitor for Indicators of Compromise.
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2018-6499 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2018-6499 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data