Vulnerabilities

Micro Focus Access Manager, an enterprise single sign-on and identity management product (formerly sold as Novell/NetIQ Access Manager), contains an information leakage vulnerability caused by a SAML service provider redirection issue when the Assertion Consumer Service (ACS) URL is used. An attacker who triggers or influences the ACS redirect path can cause SAML sign-in responses or session information to be delivered to an unintended, potentially attacker-controlled destination, exposing sensitive authentication data. The practical gain for an attacker is disclosure of federated sign-in material, which can support session hijacking or user impersonation in SAML-based flows. Any organization running Micro Focus Access Manager in a SAML service provider role is potentially affected; the source data provides no version ranges, so administrators must consult the vendor advisory for affected and fixed releases. The flaw was added to CISA's Known Exploited Vulnerability (KEV) catalog on 2021-11-03, confirming in-the-wild exploitation; no public proof-of-concept is known, CVSS has not yet been scored, and EPSS estimates a 25.7% probability of exploitation within 30 days (98th percentile).

Do: Apply the Micro Focus update for CVE-2021-22506 per the vendor security bulletin, which is CISA's required action for this KEV entry; since no fixed version numbers are given in the source data, verify your installed Access Manager release against the bulletin before patching. Review whether your deployment acts as a SAML service provider, inspect Assertion Consumer Service URL and redirect handling, and check authentication logs for unexpected redirects or assertion leakage. Treat this as urgent given confirmed in-the-wild exploitation and the elevated EPSS score, even though no public proof-of-concept exists.

CVE-2021-22502 is an unauthenticated OS command injection flaw (CWE-78) in Micro Focus Operation Bridge Reporter (OBR) version 10.40, rated critical (CVSS 9.8) because it is reachable over the network with no privileges or user interaction required. By sending crafted input to the exposed OBR service, an attacker can inject operating-system commands that are executed directly on the OBR server. Successful exploitation yields full remote code execution with the privileges of the affected service, giving attackers a foothold in enterprise IT operations environments. Organizations running OBR 10.40 — an enterprise IT-operations analytics/reporting server — are affected, particularly where the OBR interface is reachable from untrusted networks. Exploitation status is high-concern: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, a public proof-of-concept for unauthenticated command injection exists, and EPSS puts the 30-day exploitation probability at 96.7% (top percentile).

Do: Apply the vendor update for Operation Bridge Reporter per Micro Focus/OpenText instructions, as required by the CISA KEV catalog; confirm the deployed OBR build resolves 10.40. Until patched, restrict network access to the OBR server (firewall rules, VPN-only access) and hunt for signs of compromise such as unexpected processes, suspicious outbound connections, or web-shell artifacts on the server.

An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication if Guest access is enabled (Guest access is disabled by default).