Medium severity · published Mar 5, 2018
CVE-2017-7427
Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector, via vdtData in the Version discovery and via nextFrame in the Object Inspector and via Host GUID in the System details plugins.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Identity Manager · Netiq
2.7.7.7 before 4.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7427
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7427
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=1033828
www.novell.com
https://www.novell.com/support/kb/doc.php?id=7021423
More from Identity Manager
9.8
CVE-2017-9278
The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the…
9.8
CVE-2017-7434
In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles
9.1
CVE-2017-7426
The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak information or cause denial…
7.5
CVE-2017-9284
IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information
7.5
CVE-2018-7673
The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack