CVE-2021-22502criticalunder attackCWE-78

CVE-2021-22502: critical vulnerability in Operation Bridge Reporter.

Published · Updated

Follow this CVE+ Monitor Operation Bridge Reporter.+ Monitor Operation Bridge Reporter

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weapon1 day
Published on NVDFeb 8
metasploit+1d
CISA KEV+268d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A critical flaw in Micro Focus Operation Bridge Reporter version 10.40 allows attackers to execute arbitrary code remotely on the server. This means an attacker can take complete control of the affected system without needing valid credentials.

Technical detail

CWE-78 (Improper Neutralization of Special Elements used in an OS Command) in Micro Focus OBR 10.40 enables unauthenticated remote code execution through OS command injection. The vulnerability requires network access to the affected OBR instance and results in full system compromise with the privileges of the OBR service process.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Operation Bridge Reporter.
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.