CVE-2021-22502
critical · 9.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply updates per vendor instructions.
Added 2021-11-03Remediation due 2021-11-17
A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
9.8
CVSS
96.7%
EPSS (exploit prob.)
100th
EPSS percentile
2021-02-08
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| microfocus | operation_bridge_reporter | 10.40 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html
- https://softwaresupport.softwaregrp.com/doc/KM03775947
- https://www.zerodayinitiative.com/advisories/ZDI-21-153/
- https://www.zerodayinitiative.com/advisories/ZDI-21-154/
- http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html
- https://softwaresupport.softwaregrp.com/doc/KM03775947
- https://www.zerodayinitiative.com/advisories/ZDI-21-153/
- https://www.zerodayinitiative.com/advisories/ZDI-21-154/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22502
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-22502