CVE-2021-38125 Code injection in Operations Bridge containerized.
Unauthenticated attackers can execute arbitrary code on Micro Focus Operations Bridge containerized deployments upgraded from specific older versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38125?
CVE-2021-38125 is a critical code injection vulnerability in Operations Bridge containerized., published on 11 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unauthenticated remote code execution in Micro Focus Operations Bridge containerized, affecting versions 2021.05, 2021.08, and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution.
Which versions are affected by CVE-2021-38125?
It affects 1 product.
Products include Microfocus Operations Bridge.
How do I fix CVE-2021-38125?
No fix has been published for CVE-2021-38125 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-38125 being exploited?
There is no known exploitation of CVE-2021-38125 in the wild and no public exploit code.
Other vulnerabilities in Operations Bridge containerized.
- CVE-2018-18590 MFSBGN03829 rev.1 - Micro Focus Operation Bridge Containerized Suite, Remote Code Execution
- CVE-2022-38754 CVE-2022-38754 - Micro Focus Operations Bridge Manager and OpsBridge Containerized - Cross Site Scripting (XSS)
- CVE-2020-11858 Privilege escalation in Operation Bridge (containerized)
Sources
Also known as GHSA-5r8m-442m-m7hq.