CVE-2021-22502

· CRITICALAnalyzed

← All CVEs

CVSS v3.1

9.8

EPSS

96.74%

Published

Feb 8, 2021

Modified

Oct 27, 2025

CISA Known Exploited Vulnerability

Added: 2021-11-03 · Due: 2021-11-17

Apply updates per vendor instructions.

Public PoC / Exploit (2)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78CWE-78

Affected Products (1)

microfocus · operation_bridge_reportervulnerable

References (9)

http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html

ExploitThird Party AdvisoryVDB Entry

https://softwaresupport.softwaregrp.com/doc/KM03775947

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-153/

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-21-154/

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html

ExploitThird Party AdvisoryVDB Entry

https://softwaresupport.softwaregrp.com/doc/KM03775947

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-153/

Third Party AdvisoryVDB Entry

https://www.zerodayinitiative.com/advisories/ZDI-21-154/

Third Party AdvisoryVDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22502

US Government Resource

KEV Catalog EPSS Scores Vendors All CVEs