PT-2020-6292 · Micro Focus · Operation Bridge Reporter

Pedrib1337 + 1 · Published 2020-09-30 · Updated 2025-03-12 · CVE-2021-22502

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Micro Focus Operation Bridge Reporter version 10.40

Description The issue is related to a Remote Code Execution vulnerability in the Micro Focus Operation Bridge Reporter product. It could be exploited to allow Remote Code Execution on the OBR server. The vulnerability is associated with incorrect handling of parameters in the LogonResource endpoint. This could enable a remote attacker to execute arbitrary code.

Recommendations For version 10.40, consider disabling the LogonResource endpoint or restricting access to it until a patch is available. Additionally, be cautious when using the userName and token parameters in the affected API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

BDU:2021-04036

CVE-2021-22502

ZDI-21-153

ZDI-21-154

Affected Products

Operation Bridge Reporter

References · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/microfocus_obr_cmd_injection.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html · Exploit
• https://zerodayinitiative.com/advisories/ZDI-21-153 · Security Note
• https://bdu.fstec.ru/vul/2021-04036 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-154 · Security Note
• https://softwaresupport.softwaregrp.com/doc/KM03775947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22502 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22502 · Vendor Advisory
• https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild · Note
• https://t.me/cybersecuritytechnologies/2925 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cibsecurity/23262 · Telegram Post
• https://t.me/cvenotify/87454 · Telegram Post
• https://t.me/cvenotify/114528 · Telegram Post
• https://t.me/cvenotify/9639 · Telegram Post