Medium severity · published Feb 6, 2021
CVE-2021-22500
Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51. The vulnerability could be exploited by attacker to trick the users into executing actions of the attacker's choosing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Application Performance Management · Microfocus
9.40; 9.50; 9.51 · source: NVD
Affected product
AP
Application Performance Management
Microfocus
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22500
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22500
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03775253
More from Application Performance Management
9.8
CVE-2021-22514
An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51
9.8
CVE-2020-11854
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products…
8.8
CVE-2020-11853
Arbitrary code execution vulnerability affecting multiple Micro Focus products
4.8
CVE-2021-22499
Persistent Cross-Site scripting vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51