CVE-2017-7427: fallo de gravedad media en NetIQ Identity Manager
iManager - Multiple Reflected Cross-Site Scripting attacks
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.8%
Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector, via vdtData in the Version discovery and via nextFrame in the Object Inspector and via Host GUID in the System details plugins.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Productos afectados
NetIQ · Identity ManagerCVEs relacionadas — NetIQ Identity Manager
En el mismo producto, de las más peligrosas a las menos.
CVE-2016-1600—CVE-2016-1600EPSS 1.1%CVE-2018-1348MEDIUMNetIQ Identity Manager SSL RenegotiationEPSS 1.0%CVE-2017-9279LOWNetIQ Identity Manager allowed uploading of user icons with incorrect types or extensionsEPSS 0.9%CVE-2018-7676LOWIDM Information LeakageEPSS 0.8%CVE-2017-7434LOWNetIQ Identity Manager JDBC driver could leak passwords in exception tracesEPSS 0.8%CVE-2018-7673MEDIUMNetIQ Identity Manager DoS AttackEPSS 0.8%