CVE-2016-5752

Published: Mar 23, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester.

Affected (5)

Products: Netiq: Access Manager

Netiq

1 product

Access Manager

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Netiq Access Manager	Version 4.1
Netiq Access Manager	Version 4.1 sp1
Netiq Access Manager	Version 4.1 sp2
Netiq Access Manager	Version 4.2
Netiq Access Manager	Version 4.2 sp1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://www.novell.com/support/kb/doc.php?id=7017809

Source: security@opentext.com

https://www.novell.com/support/kb/doc.php?id=7017809

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.