CVE-2021-22515 - OpenCVE

Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microfocus	Netiq Advanced Authentication

Configuration 1 [-]

OR	cpe:2.3:a:microfocus:netiq_advanced_authentication::::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3::::::
	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4::::::

No data.

References

Link	Providers
https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: microfocus

Published: 2021-07-12T10:04:15.162932Z

Updated: 2024-09-17T02:36:27.218Z

Reserved: 2021-01-05T00:00:00

Link: CVE-2021-22515

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-07-12T11:15:07.713

Modified: 2023-11-07T03:30:17.387

Link: CVE-2021-22515

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "NetIQ Advanced Authentication", "vendor": "Micro Focus", "versions": [{"lessThan": "6.3 SP4 Patch 1", "status": "affected", "version": "NetIQ Advanced Authentication", "versionType": "custom"}]}], "datePublic": "2021-04-29T00:00:00", "descriptions": [{"lang": "en", "value": "Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-07-12T10:04:15", "orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "microfocus"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html"}], "solutions": [{"lang": "en", "value": "Upgrade to NetIQ Advanced Authentication Framework 6.3 SP4 Patch 1"}], "source": {"discovery": "EXTERNAL"}, "title": "Multi-Factor Authentication (MFA) downgrade exposure in NetIQ Advanced Authentication Server", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@microfocus.com", "DATE_PUBLIC": "2021-04-29T16:40:00.000Z", "ID": "CVE-2021-22515", "STATE": "PUBLIC", "TITLE": "Multi-Factor Authentication (MFA) downgrade exposure in NetIQ Advanced Authentication Server"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NetIQ Advanced Authentication", "version": {"version_data": [{"version_affected": "<", "version_name": "NetIQ Advanced Authentication", "version_value": "6.3 SP4 Patch 1"}]}}]}, "vendor_name": "Micro Focus"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication."}]}]}, "references": {"reference_data": [{"name": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html", "refsource": "CONFIRM", "url": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html"}]}, "solution": [{"lang": "en", "value": "Upgrade to NetIQ Advanced Authentication Framework 6.3 SP4 Patch 1"}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:44:14.053Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html"}]}]}, "cveMetadata": {"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "assignerShortName": "microfocus", "cveId": "CVE-2021-22515", "datePublished": "2021-07-12T10:04:15.162932Z", "dateReserved": "2021-01-05T00:00:00", "dateUpdated": "2024-09-17T02:36:27.218Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D8BAEC8-626A-4520-A89F-DB40CC774D87", "versionEndExcluding": "6.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-:*:*:*:*:*:*", "matchCriteriaId": "689649F7-75D8-4D13-9A71-50C2908EACA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1:*:*:*:*:*:*", "matchCriteriaId": "A0F82417-D88A-40C5-AD90-7AB826E29C2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2:*:*:*:*:*:*", "matchCriteriaId": "0DD98BB8-7A85-41D6-B1CB-7849D61F085A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3:*:*:*:*:*:*", "matchCriteriaId": "729C4860-8CAC-4D4B-8C68-00B1E84E700A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4:*:*:*:*:*:*", "matchCriteriaId": "FEFFEB38-B4CA-48ED-9149-073334346CA3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1."}, {"lang": "es", "value": "Una funcionalidad de Autenticaci\u00f3n Multifactor (MFA) puede ser omitida, permitiendo el uso de la autenticaci\u00f3n de un solo factor en NetIQ Advanced Authentication versiones anteriores a 6.3 SP4 Parche 1"}], "id": "CVE-2021-22515", "lastModified": "2023-11-07T03:30:17.387", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@opentext.com", "type": "Secondary"}]}, "published": "2021-07-12T11:15:07.713", "references": [{"source": "security@opentext.com", "url": "https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}