CVE-2021-22502: Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability

Vulnerability summary

CVE-2021-22502 is a high (CVSS 10.0) OS Command Injection vulnerability in Micro Focus Operation Bridge Reporter (OBR). It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 96.74% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 08-02-2021
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVMicro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability
3. 17-11-2021
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.