CVE-2021-22506: Micro Focus Access Manager Information Leakage Vulnerability

CVE-2021-22506 is an information leakage vulnerability in Micro Focus Access Manager. It stems from a SAML service provider redirection issue when the Assertion Consumer Service URL is used, which can allow unintended disclosure of information. For IT and security teams running this product in identity and access workflows, the issue matters because Access Manager often sits on authentication paths; leakage there can expose details useful for further abuse of federated login flows. Confirm all product and fix details against the vendor advisory.

How it works

Public detail describes this as an information leakage vulnerability caused by a SAML service provider redirection issue tied to use of the Assertion Consumer Service URL. In SAML-based single sign-on, the service provider and identity provider exchange assertions and redirect the user browser to complete authentication. When redirection handling around the Assertion Consumer Service URL is flawed, an attacker who can influence or observe that flow may obtain information that should remain protected.

The exact weakness class (CWE) is not specified in the provided record. At a high level for this product class, the abuse path involves interacting with the SAML redirection behavior so that sensitive data is returned or exposed outside the intended trust boundary. Do not assume specific request parameters, payloads, or preconditions; those must be taken only from the vendor advisory. The practical risk is unauthorized disclosure that can aid reconnaissance or follow-on attacks against the access management environment.

Am I affected? How to find it in your systems

Micro Focus Access Manager is typically deployed as an enterprise identity and access management component, often in front of internal applications, portals, or federated partner integrations that rely on SAML. Inventory any hosts, appliances, or clusters running Access Manager, including development, test, and production instances, and any reverse proxies or load balancers that terminate SAML traffic for it.

• Identify installations by package inventories, configuration management databases, appliance management consoles, and network service banners associated with Access Manager.
• Review SAML service provider configurations, especially those that define or accept Assertion Consumer Service URLs, and note which applications rely on them.
• Compare installed versions and patch levels to the fixed releases named in the vendor advisory; do not rely on version guesses.
• For exploitation signs, examine access and federation logs for unusual redirection patterns, unexpected Assertion Consumer Service URL values, anomalous SAML response handling, or repeated requests that deviate from normal SSO traffic. Correlate with authentication anomalies and outbound data that should not leave the IdP/SP boundary.

If you cannot confirm version or configuration status internally, treat systems running Access Manager SAML SP features as in-scope until verified against the advisory.

How to remediate

Patch first. Apply the updates provided by the vendor for Micro Focus Access Manager exactly as described in the vendor instructions and the CISA-required action to apply updates per vendor instructions. Schedule the change through your normal change process, including backups of configuration and federation metadata, then verify SAML flows still complete correctly after the update.

• After patching, re-validate Assertion Consumer Service URL handling and related SAML SP settings against hardened baselines.
• Restrict which ACS URLs and redirect targets are permitted; prefer explicit allow-lists over open or loosely validated redirection.
• Ensure federation metadata and certificates are current, and remove unused SAML integrations.
• Re-test authentication and logout paths, and confirm logging captures enough detail to detect abnormal redirections going forward.

If the advisory lists additional configuration changes beyond the binary or package update, implement those as part of the same remediation window.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls focused on the SAML redirection and information-leakage class of issues.

• Segment Access Manager so only required clients, identity providers, and application tiers can reach the SAML endpoints; block general internet or broad internal access where possible.
• Use a reverse proxy or WAF in front of the SAML endpoints to enforce strict allow-lists on redirect and ACS-related parameters, and to rate-limit or alert on anomalous federation requests. Treat any virtual patch rules as temporary and validate them so legitimate SSO is not broken.
• Disable or temporarily take offline non-essential SAML service provider integrations that use the affected Assertion Consumer Service URL behavior, if business allows.
• Increase monitoring on authentication and reverse-proxy logs for unusual redirects, unexpected destinations, or repeated probing of SAML endpoints; forward these to your SIEM and alert on deviations from baseline SSO traffic.
• Enforce strong administrative access controls to the Access Manager management interfaces so an information leak cannot be combined easily with admin compromise.

These steps do not replace the patch; they only lower likelihood and impact until the vendor fix is installed.

If your data may have been exposed

Actively exploited vulnerabilities in access management products can lead to unauthorized access or data exposure even when ransomware use is not documented for this CVE. If you have indicators of exploitation or cannot rule out exposure, follow your incident response process: preserve logs, rotate relevant secrets and federation credentials as appropriate, and assess what information may have left the system. You can run a free exposure scan of your email addresses to check whether they appear in known breach data and prioritize further monitoring and credential hygiene accordingly.