6.5

CVE-2021-22515

Multi-Factor Authentication (MFA) downgrade exposure in NetIQ Advanced Authentication Server

Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microfocus ≫ Netiq Advanced Authentication Version 6.3 Update -
Microfocus ≫ Netiq Advanced Authentication Version 6.3 Update sp1
Microfocus ≫ Netiq Advanced Authentication Version 6.3 Update sp2
Microfocus ≫ Netiq Advanced Authentication Version 6.3 Update sp3
Microfocus ≫ Netiq Advanced Authentication Version 6.3 Update sp4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.69% 0.477
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
OpenText 4.8 1.2 3.6
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6341/data/advanced-authentication-releasenotes-6341.html