Lucene search

OpenTextCVE-2021-22530

HistoryAug 28, 2024 - 7:15 a.m.

CVE-2021-22530

2024-08-2807:15:06

CWE-307

CWE-667

OpenText

web.nvd.nist.gov

vulnerability

netiq advance authentication

account lockout

api login

brute force attack

user compromise

server performance

cve-2021-22530

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

37.8%

JSON

A vulnerability identified in NetIQ Advance Authentication that doesn’t enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue impacts all NetIQ Advance Authentication before 6.3.5.1

Affected configurations

Nvd

Node

microfocusnetiq_advanced_authenticationRange<6.3

microfocusnetiq_advanced_authenticationMatch6.3-

microfocusnetiq_advanced_authenticationMatch6.3sp1

microfocusnetiq_advanced_authenticationMatch6.3sp2

microfocusnetiq_advanced_authenticationMatch6.3sp3

microfocusnetiq_advanced_authenticationMatch6.3sp4

microfocusnetiq_advanced_authenticationMatch6.3sp4_patch1

microfocusnetiq_advanced_authenticationMatch6.3sp5

VendorProductVersionCPE
microfocusnetiq_advanced_authentication*cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:*
microfocusnetiq_advanced_authentication6.3cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-:*:*:*:*:*:*
microfocusnetiq_advanced_authentication6.3cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1:*:*:*:*:*:*
microfocusnetiq_advanced_authentication6.3cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2:*:*:*:*:*:*
microfocusnetiq_advanced_authentication6.3cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3:*:*:*:*:*:*
microfocusnetiq_advanced_authentication6.3cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4:*:*:*:*:*:*
microfocusnetiq_advanced_authentication6.3cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1:*:*:*:*:*:*
microfocusnetiq_advanced_authentication6.3cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5:*:*:*:*:*:*

Vendor	Product	Version	CPE
microfocus	netiq_advanced_authentication	*	cpe:2.3:a:microfocus:netiq_advanced_authentication::::::::
microfocus	netiq_advanced_authentication	6.3	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-::::::
microfocus	netiq_advanced_authentication	6.3	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1::::::
microfocus	netiq_advanced_authentication	6.3	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2::::::
microfocus	netiq_advanced_authentication	6.3	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3::::::
microfocus	netiq_advanced_authentication	6.3	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4::::::
microfocus	netiq_advanced_authentication	6.3	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1::::::
microfocus	netiq_advanced_authentication	6.3	cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "NetIQ Advance Authentication",
    "vendor": "OpenText",
    "versions": [
      {
        "lessThan": "<",
        "status": "affected",
        "version": "6.3.5.1",
        "versionType": "server"
      }
    ]
  }
]

References

www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6351/data/advanced-authentication-releasenotes-6351.html

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

37.8%

JSON

Related for CVE-2021-22530