Critical severity · published Apr 28, 2021
CVE-2021-22514
An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51
9.8
CVSS
2%
EPSS
No
On KEV
Description
An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9.40, 9.50 and 9.51. The vulnerability could allow remote attackers to execute arbitrary code on affected installations of APM.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Application Performance Management · Microfocus
9.40; 9.50; 9.51 · source: NVD
Affected product
AP
Application Performance Management
Microfocus
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22514
softwaresupport.softwaregrp.com
https://softwaresupport.softwaregrp.com/doc/KM03806649
More from Application Performance Management
9.8
CVE-2020-11854
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products…
8.8
CVE-2020-11853
Arbitrary code execution vulnerability affecting multiple Micro Focus products
6.5
CVE-2021-22500
Cross Site Request Forgery vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51
4.8
CVE-2021-22499
Persistent Cross-Site scripting vulnerability in Micro Focus Application Performance Management product, affecting versions 9.40, 9.50 and 9.51