« Volver al listado

CVE-2021-22531

Estado: ModificadaMedia (6.1)—

A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ Access Manager 4.5 and 5.0

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microfocus — Access Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22531",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "NetIQ Access Manager",
          "versions": [
            {
              "status": "affected",
              "version": "4.5, 5.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-12T19:15:48.020",
  "references": [
    {
      "url": "https://www.microfocus.com/documentation/access-manager/5.0/accessmanager502-release-notes/accessmanager502-release-notes.html",
      "source": "security@opentext.com"
    },
    {
      "url": "https://www.microfocus.com/documentation/access-manager/5.0/accessmanager502-release-notes/accessmanager502-release-notes.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ Access Manager 4.5 and 5.0"
    },
    {
      "lang": "es",
      "value": "Se presenta un bug en el parámetro input de Access Manager que permite a el suministro de caracteres no válidos desencadenar una vulnerabilidad de tipo cross-site scripting. Esto afecta a NetIQ Access Manager versiones 4.5 y 5.0"
    }
  ],
  "lastModified": "2026-06-17T03:37:23.590",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8E97E1C-2026-4FC1-8DDE-EC0BFB043048"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:hotfix1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5438260E-68B8-4139-BA41-1FDBD2AFA633"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71F2BB55-B83E-40A7-9D0F-66DC2737C02A"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp1_hotfix1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18C50F58-7AB2-48BC-8575-439F3F435261"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp1_hotfix2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6EA171E-57CD-4537-985C-E4F088079F4B"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C0301E3-240B-40E6-86CC-DF2D5FBF9C0D"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp2_hotfix1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2A5335F-63DD-4521-A2D8-8523F1C32C15"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp2_hotfix2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE115264-03EC-42B4-B0AB-CC9F4DBD3618"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F7074C1-8377-490A-86B0-5D7291017412"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp3_hotfix1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4692C49-419C-440A-B418-92BA7ACCBC11"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp3_patch3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA7ECB22-DF54-40CA-B129-20BEEAC58226"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "516FEB2A-09BE-4099-99C5-BCCC2EB33C8D"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:4.5:sp5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D03D5653-F0B9-48BC-ACA4-910E80275DFB"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:5.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24EE84C8-36FC-4D39-91AF-277021E82B9C"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:access_manager:5.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08E6E8DF-5652-4CE6-BF88-BFFF98B71FFD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}