CVE-2021-22498

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-19 · updated 2026-06-17
Weakness: CWE-611

Description

XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. The vulnerability affects versions 12.x, 12.60 Patch 5 and earlier, 15.0.1 Patch 2 and earlier and 15.5. The vulnerability could be exploited to allow an XML External Entity Injection.

Affected products

Application Lifecycle Management ( Previously known as Quality Center ).: from 12.50 through 12.60; from 15.0.0 through 15.0.1; 12.60-patch1, 12.60-patch2, 12.60-patch3, 12.60-patch4, 12.60-patch5, 15.0.1-patch1 (+2)

References

https://softwaresupport.softwaregrp.com/doc/KM03771781
https://softwaresupport.softwaregrp.com/doc/KM03771781

Get alerted when CVE-2021-22498 or the next vulnerability affects your stack