CVE-2021-22515: Multi-Factor Authentication (MFA) downgrade exposure in NetIQ Advanced Authentication Server
First published: Thu Apr 29 2021(Updated: )
Multi-Factor Authentication (MFA) functionality can be bypassed, allowing the use of single factor authentication in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1.
Credit: security@microfocus.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microfocus Netiq Advanced Authentication | <6.3 | |
| Microfocus Netiq Advanced Authentication | =6.3 | |
| Microfocus Netiq Advanced Authentication | =6.3-sp1 | |
| Microfocus Netiq Advanced Authentication | =6.3-sp2 | |
| Microfocus Netiq Advanced Authentication | =6.3-sp3 | |
| Microfocus Netiq Advanced Authentication | =6.3-sp4 |
Remedy
Upgrade to NetIQ Advanced Authentication Framework 6.3 SP4 Patch 1
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2021-22515?
CVE-2021-22515 refers to a vulnerability in NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1 that allows the bypassing of Multi-Factor Authentication (MFA) functionality, enabling the use of single factor authentication.
Which software versions are affected by CVE-2021-22515?
NetIQ Advanced Authentication versions prior to 6.3 SP4 Patch 1 are affected by CVE-2021-22515.
What is the severity of CVE-2021-22515?
CVE-2021-22515 has a severity rating of 6.5 (medium).
How can the bypass of MFA functionality in NetIQ Advanced Authentication be fixed?
To fix the bypass of MFA functionality, it is recommended to upgrade to NetIQ Advanced Authentication version 6.3 SP4 Patch 1 or a later release.
Where can I find more information about CVE-2021-22515?
More information about CVE-2021-22515 can be found in the NetIQ Advanced Authentication Release Notes.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/weakness
- agent/severity
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/event
- agent/description
- agent/tags
- agent/first-publish-date
- vendor/microfocus
- canonical/microfocus netiq advanced authentication
- version/microfocus netiq advanced authentication/6.3
- version/microfocus netiq advanced authentication/6.3-sp1
- version/microfocus netiq advanced authentication/6.3-sp2
- version/microfocus netiq advanced authentication/6.3-sp3
- version/microfocus netiq advanced authentication/6.3-sp4