Critical severity · published Feb 12, 2021
CVE-2021-22504
Arbitrary code execution vulnerability on Micro Focus Operations Bridge Manager product, affecting versions 10.1x, 10.6x, 2018.05, 2018.11, 2019.05, 2019.11, 2020.05, 2020.10
9.8
CVSS
3.5%
EPSS
No
On KEV
Description
Arbitrary code execution vulnerability on Micro Focus Operations Bridge Manager product, affecting versions 10.1x, 10.6x, 2018.05, 2018.11, 2019.05, 2019.11, 2020.05, 2020.10. The vulnerability could allow remote attackers to execute arbitrary code on an OBM server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Operations Bridge Manager · Microfocus
10.10; 10.11; 10.12; 10.60; 10.61; 10.62; +7 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22504
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03777855
More from Operations Bridge Manager
9.8
CVE-2021-22507
Authentication bypass vulnerability in Micro Focus Operations Bridge Manager affects versions 2019.05, 2019.11, 2020.05 and 2020.10
9.8
CVE-2020-11854
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products…
8.8
CVE-2020-11853
Arbitrary code execution vulnerability affecting multiple Micro Focus products
7.8
CVE-2020-11858
Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized)
5.4
CVE-2022-38754
A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized