CVE-2021-22502 Micro Focus Operation Bridge Report (OBR) Remote Code Execution
Attackers can execute arbitrary code remotely on Micro Focus Operation Bridge Reporter servers via command injection.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22502?
CVE-2021-22502 is a critical command injection vulnerability in Operation Bridge Reporter., published on 8 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
Weakness: CWE-78
Which versions are affected by CVE-2021-22502?
It affects 1 product.
Products include Microfocus Operation Bridge Reporter.
How do I fix CVE-2021-22502?
No fix has been published for CVE-2021-22502 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-22502 being exploited?
Yes. Attackers have exploited CVE-2021-22502 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Metasploit module and 1 Nuclei template.
Other vulnerabilities in Operation Bridge Reporter.
Sources
Also known as GHSA-9f78-r2f6-597q.