CVE-2021-22502: 
Operations Bridge Reporter vulnerability analysis and mitigation

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability, tracked as CVE-2021-22502, was discovered in September 2020 and publicly disclosed on February 9, 2021. The vulnerability could be exploited to allow Remote Code Execution on the OBR server without requiring authentication (ZDI Advisory, Micro Focus KB).

The vulnerability exists within the handling of the userName parameter provided to the LogonResource endpoint and the Token parameter provided to the LogonResource endpoint. The issue results from the lack of proper validation of user-supplied strings before using them to execute system calls. The vulnerability has received a CVSS v3.0 base score of 10.0 (Critical) with the vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (ZDI Advisory, Micro Focus KB).

An attacker can leverage this vulnerability to execute arbitrary code in the context of root on the affected OBR server. Given the highest possible CVSS score and root-level execution capability, this vulnerability represents a critical risk to affected systems (ZDI Advisory).

The vulnerability is highly exploitable as it requires no authentication and can be triggered remotely. The attack vector is network-accessible with low complexity, making it an attractive target for attackers (Micro Focus KB).

Micro Focus has released security updates to address this vulnerability. Organizations running affected versions of Operations Bridge Reporter 10.40 should apply the available patches immediately. Detailed mitigation information is available through Micro Focus support (Micro Focus KB).