Micro Focus · Micro Focus Access Manager

CVE-2021-22506

Micro Focus Access Manager Information Leakage Vulnerability

Exploited in attacks High 7.5 Attack chance: 26%

What it is

Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.

CISA: Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: November 17, 2021

Added to the CISA list: November 3, 2021
Published: March 26, 2021
Severity: High 7.5 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 26% in the top 2.0% of all known vulnerabilities
More details: NVD · CVE.org · CISA

All references (1)

https://www.microfocus.com/documentation/access-manager/5.0/accessmanager50-release-notes/accessmanager50-rel…

More exploited flaws from Micro Focus

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Operation Bridge Report (OBR) Remote Code ExecutionCVE-2021-22502	Operation Bridge Reporter (OBR)	Critical 9.8	97%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.