PT-2021-3857 · Micro Focus · Micro Focus Access Manager

Published 2021-03-26 · Updated 2025-03-12 · CVE-2021-22506

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Micro Focus Access Manager versions prior to 5.0

Description The issue is related to an information leakage vulnerability in the Advance configuration of Micro Focus Access Manager. This vulnerability could cause information leakage. The vulnerability is also related to the implementation of the SAML authentication technology, which has insufficient protection of service data, allowing a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and configuring the Access Manager to minimize the risk of exploitation. Restrict access to the SAML authentication module to minimize the risk of unauthorized access.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2021-04215

CVE-2021-22506

Affected Products

Micro Focus Access Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-22506 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22506 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04215 · Security Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/114529 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22506 · Note
• https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild · Note
• https://microfocus.com/documentation/access-manager/5.0/accessmanager50-release-notes/accessmanager50-release-notes.html · Note