CVE-2021-22502 kev in the critical feed json
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40.
published 2021-02-08 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-9648
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2021-11-03
- epss
- 96.7%
- EPSS 96.7% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
Patch / fix
cisa required action Apply updates per vendor instructions.
Timeline
- Published
- First public exploit (Metasploit exploit/linux/http/microfocus_obr_cmd_injection)
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 5 y ago
- Patch by
- 2021-11-17 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Micro Focus, Operation Bridge Reporter (OBR)
- CISA name
- Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
96.74% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/microfocus_obr_cmd_injection Micro Focus Operations Bridge Reporter Unauthenticated Command Injection metasploit exploit, excellent rank, 2021-02-09
- Nuclei template Micro Focus Operations Bridge Reporter - Remote Code Execution nuclei detection template
- packetstormsecurity.com http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- n/a Operation Bridge Reporter.
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
packetstormsecurity.com
/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html
exploit, third-party-advisory, vdb-entry
-
softwaresupport.softwaregrp.com
/doc/KM03775947
vendor-advisory
-
zerodayinitiative.com
/advisories/ZDI-21-153/
third-party-advisory, vdb-entry
-
zerodayinitiative.com
/advisories/ZDI-21-154/
third-party-advisory, vdb-entry
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22502
government-resource, us-government-resource
Sources
- CVE List CVE-2021-22502
- NVD CVE-2021-22502
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.