CVE-2021-22502

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

Affected

Operation Bridge Reporter.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

96.74% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03

Nuclei

critical · CWE-78

Published

2021-02-08

Updated

2025-10-21

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauth…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22502.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/microfocus_obr_cmd_in…

Security advisories

• https://softwaresupport.softwaregrp.com/doc/KM03775947
• https://www.zerodayinitiative.com/advisories/ZDI-21-153
• https://www.zerodayinitiative.com/advisories/ZDI-21-154

References

• CVE Record
• NVD entry