PT-2021-15116 · Micro Focus · Micro Focus Application Automation Tools Plugin

Long Nguyen · Published 2021-04-08 · Updated 2022-05-24 · CVE-2021-22513

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Micro Focus Application Automation Tools Plugin versions 6.7 and earlier

Description The issue is related to missing authorization in the Micro Focus Application Automation Tools Plugin, which could allow access without permission checks. This affects methods implementing form validation, enabling attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password. Additionally, the form validation methods are vulnerable to cross-site request forgery (CSRF) as they do not require POST requests.

Recommendations For versions 6.7 and earlier, consider updating to version 6.8 or later, which requires POST requests and Overall/Administer permission for the affected form validation methods, thus mitigating the issue. As a temporary workaround, consider restricting access to the form validation methods to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-22513

GHSA-7QP2-RGXR-29Q4

Affected Products

Micro Focus Application Automation Tools Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-7qp2-rgxr-29q4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22513 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22513 · Vendor Advisory
• https://github.com/jenkinsci/hpe-application-automation-tools-plugin/commit/497a143d9a95e9c937501ca329fe0dae22a0d9cd · Note
• https://github.com/jenkinsci/hpe-application-automation-tools-plugin · Note
• https://jenkins.io/security/advisory/2021-04-07/#SECURITY-2132 · Note
• https://t.me/cvenotify/13227 · Telegram Post