CVE-2014-5214: Micro Focus Access Manager

Medium severity, CVSS 4.0. EPSS: 1.9% chance of exploitation in the next 30 days.

nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected products

• Micro Focus Access Manager: version 4.0 only; version 4.0.1 only

Published 2014-12-23. Last modified 2026-06-17.