CVE-2021-22502
CRITICAL KEV NUCLEIMicro Focus Operation Bridge Reporter <10.40 - RCE
Title source: llmExploitation Summary
CVE-2021-22502 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 1 public exploit, including a Metasploit module exploits/linux/http/microfocus_obr_cmd_injection.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated command injection vulnerability in Micro Focus Operations Bridge Reporter (OBR) on Linux versions <= 10.40. The exploit injects a payload into the 'userName' field of a JSON POST request to the login endpoint, leveraging improper input validation to achieve remote code execution.
Description
Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.
Exploits (1)
This Metasploit module exploits an unauthenticated command injection vulnerability in Micro Focus Operations Bridge Reporter (OBR) on Linux versions <= 10.40. The exploit injects a payload into the 'userName' field of a JSON POST request to the login endpoint, leveraging improper input validation to achieve remote code execution.
Nuclei Templates (1)
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H