Unscored severity · published Dec 24, 2012
CVE-2012-5930
The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method,…
–
CVSS
7.4%
EPSS
No
On KEV
Description
The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Privileged User Manager · Microfocus
2.3.0; 2.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5930
download.novell.com
http://download.novell.com/Download?buildid=K6-PmbPjduA~
Exploit
http://retrogod.altervista.org/9sg_novell_netiq_i.htm
Exploit
http://retrogod.altervista.org/9sg_novell_netiq_i_adv.htm
Vendor Advisory
https://www.netiq.com/support/kb/doc.php?id=7011385
More from Privileged User Manager
–
CVE-2012-5932
Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute…
–
CVE-2012-5931
Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated…