Actively exploited · Published Feb 8, 2021 · Assigned by microfocus

CVE-2021-22502

Critical 9.8 Exploited

In plain English

A critical-severity OS command injection in Operation Bridge Reporter.. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 96.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)96.7%top 0.1% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling2Metasploit, Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

Affected products (as reported)

Vendor	Product	Versions
n/a	Operation Bridge Reporter.	OBR 10.40

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://softwaresupport.softwaregrp.com/doc/KM03775947 x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-153/ x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-154/ x_refsource_MISC
http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22502 government-resource