CVE-2021-22498

microfocus application lifecycle management

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-22498

Katalog CVE

CVSS 8.1 · High EPSS 0,96%

Kerentanan Improper Restriction of XML External Entity Reference pada microfocus application lifecycle management. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability affects versions 12.x, 12.60 Patch 5 and earlier, 15.0.1 Patch 2 and earlier and 15.5. The vulnerability could be exploited to allow an XML External Entity Injection.

Rincian

Terbit di NVD
19 Januari 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-611: Improper Restriction of XML External Entity Reference
EPSS (30 hari)
0,96% peluang dieksploitasi; lebih tinggi dari 60,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
microfocus application lifecycle management Versi 12.50 hingga 12.60
microfocus application lifecycle management Versi 15.0.0 hingga 15.0.1
microfocus application lifecycle management Versi 12.60 patch1
microfocus application lifecycle management Versi 12.60 patch2
microfocus application lifecycle management Versi 12.60 patch3
microfocus application lifecycle management Versi 12.60 patch4
microfocus application lifecycle management Versi 12.60 patch5
microfocus application lifecycle management Versi 15.0.1 patch1
microfocus application lifecycle management Versi 15.0.1 patch2
microfocus application lifecycle management Versi 15.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.