by Kastro
Paper/Archive/CVE-2021-22502

CVE-2021-22502

Micro Focus Operation Bridge Reporter (OBR) — Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

KEV · due 17 NovEPSS 97%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

Affected

ProductAffectedFixed inSource
Operation Bridge Reporter.OBR 10.40–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsoftwaresupport.softwaregrp.com/doc/KM03775947refzerodayinitiative.com/advisories/ZDI-21-153refzerodayinitiative.com/advisories/ZDI-21-154refpacketstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22502kevcisa.gov/known-exploited-vulnerabilities-catalog