High‑Severity Information Leakage in Micro Focus Access Manager (CVE‑2021‑22506)
What It Is
Micro Focus Access Manager (AM) suffers an information‑leakage flaw in its SAML service‑provider flow. When the Assertion Consumer Service (ACS) URL is supplied, the product can be coerced into redirecting the SAML response to an attacker‑controlled endpoint, exposing authentication assertions and related metadata.
Exploitability
- Active exploitation: No public exploit reports, but the vulnerability is classified High by CISA and listed in the Known Exploited Vulnerabilities (KEV) catalog, indicating a realistic threat landscape.
- Proof‑of‑Concept: Sample request manipulation has been demonstrated in vendor advisories; a full exploit chain is feasible for threat actors with network access to the SAML endpoint.
- CVSS: Base score ≈ 7.5 (CVSS v3.1) – reflects confidentiality impact and low complexity.
Affected Products
- Vendor: Micro Focus
- Product: Micro Focus Access Manager (all supported versions prior to the vendor‑released patch)
Why It Matters for Compliance & Audit Readiness
The leak directly undermines access‑control assurance and the confidentiality pillar of most regulatory frameworks (e.g., NIST 800‑53 AC‑1, ISO 27001 A.9).
- Continuous Control Monitoring: Detecting anomalous SAML redirects becomes a required control evidence point.
- Vendor‑Management Controls: The issue highlights the need for a documented patch‑management workflow and proof of timely remediation in audit artifacts.
- Defensible Audit Trail: Capturing SAML‑flow logs and remediation tickets provides the evidence auditors expect for “adequate protection of authentication data.”
Recommended Actions
- Patch Immediately: Apply Micro Focus’s security update that validates ACS URLs against a whitelist.
- Validate SAML Configurations: Review all Service Provider (SP) metadata; enforce strict URL whitelisting and enable signed assertions.
- Enable Logging & Alerting: Log SAML request/response headers; set alerts for redirects to non‑trusted domains.
- Update Vendor Risk Register: Record the CVE, remediation status, and evidence of control testing.
- Document Evidence: Capture patch deployment records, configuration snapshots, and monitoring alerts for audit review.
Source: CISA KEV – CVE‑2021‑22506