Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2
Priority MEDIUM 50CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00863 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | NetIQ Advanced Authentication | versions prior to 6.4.1.1 and 6.3.7.2 | — | No fix listed | CNA |
- NetIQ Advanced Authentication Vendor— Affected versions prior to 6.4.1.1 and 6.3.7.2 Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:* | before 6.3 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-:*:*:*:*:*:* | 6.3 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1:*:*:*:*:*:* | 6.3 sp1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2:*:*:*:*:*:* | 6.3 sp2 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3:*:*:*:*:*:* | 6.3 sp3 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4:*:*:*:*:*:* | 6.3 sp4 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1:*:*:*:*:*:* | 6.3 sp4_patch1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5:*:*:*:*:*:* | 6.3 sp5 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5_patch1:*:*:*:*:*:* | 6.3 sp5_patch1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5_patch2:*:*:*:*:*:* | 6.3 sp5_patch2 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:netiq_advanced_authentication:*:*:*:*:*:*:*:* Versions before 6.3 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:-:*:*:*:*:*:* Versions 6.3 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp1:*:*:*:*:*:* Versions 6.3 sp1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp2:*:*:*:*:*:* Versions 6.3 sp2 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp3:*:*:*:*:*:* Versions 6.3 sp3 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4:*:*:*:*:*:* Versions 6.3 sp4 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp4_patch1:*:*:*:*:*:* Versions 6.3 sp4_patch1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5:*:*:*:*:*:* Versions 6.3 sp5 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5_patch1:*:*:*:*:*:* Versions 6.3 sp5_patch1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp5_patch2:*:*:*:*:*:* Versions 6.3 sp5_patch2 Vulnerable ·Micro Focus International
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp6:*:*:*:*:*:* | 6.3 sp6 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp6_patch1:*:*:*:*:*:* | 6.3 sp6_patch1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp7:*:*:*:*:*:* | 6.3 sp7 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.4:-:*:*:*:*:*:* | 6.4 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:netiq_advanced_authentication:6.4:sp1:*:*:*:*:*:* | 6.4 sp1 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp6:*:*:*:*:*:* Versions 6.3 sp6 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp6_patch1:*:*:*:*:*:* Versions 6.3 sp6_patch1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.3:sp7:*:*:*:*:*:* Versions 6.3 sp7 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.4:-:*:*:*:*:*:* Versions 6.4 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:netiq_advanced_authentication:6.4:sp1:*:*:*:*:*:* Versions 6.4 sp1 Vulnerable ·Micro Focus International
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-24468
- 2026-10-03 Alias added: GHSA-6xff-36r8-rhfg
References
Other 2
- https://www.netiq.com/documentation/advanced-authentication-63/advanced-authentication-releasenotes-6372/data/advanced-authentication-releasenotes-6372.html
- https://www.netiq.com/documentation/advanced-authentication-64/advanced-authentication-releasenotes-6411/data/advanced-authentication-releasenotes-6411.html
More Micro Focus International Netiq Advanced Authentication vulnerabilities
- TI-2021-05498 Improper account management vulnerability in NetIQ Advance Authentication CVSS 3.1CRITICAL 9.9
- TI-2021-15804 Weak communication protocol identified in Advance Authentication client application CVSS 3.1HIGH 8.8
- TI-2021-05478 Handling of sensitive data in process memory in NetIQ Advance Authentication CVSS 3.1HIGH 8.1
- TI-2021-15805 Cross-Site Scripting (XSS) in Advance Authentication CVSS 3.1HIGH 8.2
- TI-2021-05466 Advanced Authentication Improper Session Management CVSS 3.1HIGH 7.2
- TI-2021-15803 Remote Code Execution using Bash command Injection in backup scheduling functionality in NetIQ Advance Authentication CVSS 3.1HIGH 7.2
Sources
- CVE-2023-24468 · CVE Program
- CVE-2023-24468 · NVD
- FIRST EPSS
- GHSA-6xff-36r8-rhfg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences