High severity · published Mar 26, 2021
CVE-2021-22506
Micro Focus Access Manager Information Leakage Vulnerability
In wildKEV
7.5
CVSS
25.7%
EPSS
Yes
On KEV
Description
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. The vulnerability could cause information leakage.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)25.7% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueNov 17, 2021
Ransomware campaign useNot known
Affected products
Which versions
AM
Access Manager. ·
All version prior version 5.0. · source: vendor
AM
Access Manager · Microfocus
before 5.0 · source: NVD
MF
Micro Focus Access Manager · Micro Focus
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22506
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.microfocus.com/documentation/access-manager/5.0/accessmanager50-release-notes/accessmanager50-release-notes.html