PT-2021-15107 · Micro Focus · Micro Focus Application Lifecycle Management

Published 2021-01-19 · Updated 2021-01-29 · CVE-2021-22498

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Micro Focus Application Lifecycle Management versions 12.x through 15.5 Micro Focus Application Lifecycle Management versions 12.60 Patch 5 and earlier Micro Focus Application Lifecycle Management versions 15.0.1 Patch 2 and earlier

Description The issue is related to an XML External Entity Injection, which could be exploited to allow an XML External Entity Injection.

Recommendations For versions 12.x through 15.5, update to a version later than 15.5. For versions 12.60 Patch 5 and earlier, apply a patch later than Patch 5. For versions 15.0.1 Patch 2 and earlier, apply a patch later than Patch 2.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-22498

Affected Products

Micro Focus Application Lifecycle Management

References · 4

• https://osv.dev/vulnerability/CVE-2021-22498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22498 · Security Note
• https://softwaresupport.softwaregrp.com/doc/KM03771781 · Note
• https://t.me/cibsecurity/22280 · Telegram Post