CVE-2021-22502

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

96.74% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03

Nuclei

critical · CWE-78

Published

2021-02-08

Updated

2025-10-21

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauth…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22502.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/microfocus_obr_cmd_in…

References

• CVE Record
• NVD entry

Related

• CVE-2021-22448
• CVE-2021-22543
• CVE-2021-22214
• CVE-2021-22555
• CVE-2021-22210
• CVE-2021-22557