« Volver al listado

CVE-2021-22498

Estado: ModificadaAlta (8.1)—

XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability affects versions 12.x, 12.60 Patch 5 and earlier, 15.0.1 Patch 2 and earlier and 15.5. The vulnerability could be exploited to allow an XML External Entity Injection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microfocus — Application Lifecycle Management

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22498",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Application Lifecycle Management ( Previously known as Quality Center ).",
          "versions": [
            {
              "status": "affected",
              "version": "Affected versions are:  12.x, 12.60 Patch 5 and earlier, 15.0.1 Patch 2 and earlier and 15.5."
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-01-19T16:15:13.250",
  "references": [
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03771781",
      "source": "security@opentext.com"
    },
    {
      "url": "https://softwaresupport.softwaregrp.com/doc/KM03771781",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability affects versions 12.x, 12.60 Patch 5 and earlier, 15.0.1 Patch 2 and earlier and 15.5. The vulnerability could be exploited to allow an XML External Entity Injection."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Inyección de Entidad Externa XML en el producto Micro Focus Application Lifecycle Management (anteriormente se conoce como Quality Center). La vulnerabilidad afecta a las versiones 12.x, 12.60 Parche 5 y anteriores, 15.0.1 Parche 2 y anteriores y 15.5. La vulnerabilidad podría ser explotada para permitir una Inyección de Entidad Externa XML"
    }
  ],
  "lastModified": "2026-06-17T03:37:19.777",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04E989E6-96B6-431F-A68E-44C3DC4CCC31",
              "versionEndIncluding": "12.60",
              "versionStartIncluding": "12.50"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C2AA512-D7E4-4ABF-B495-542D4EB856C3",
              "versionEndIncluding": "15.0.1",
              "versionStartIncluding": "15.0.0"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:12.60:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7424FAB0-201A-4908-8826-245DA119C5F7"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:12.60:patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48260409-EAC4-4294-A665-76F5D97F74BC"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:12.60:patch3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D261545-AB84-4C3D-8EDB-9986B5B5C252"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:12.60:patch4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E49D67E6-5499-4653-B945-C17DE52ADD2C"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:12.60:patch5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E19D3008-08D5-4E5F-9F67-99E917EDE855"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:15.0.1:patch1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B90BEA78-299C-4AE2-ABE7-D499F05C4E8B"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:15.0.1:patch2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41910128-1873-40CB-9875-48940AC95AD8"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:application_lifecycle_management:15.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5B5A87A-BE3D-4041-A971-8DF3A32D578A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}