← Back

CVE-2017-7429

nvd nist
Published: Mar 2, 2018Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server.

Affected (7)

Microfocus
1 product
Edirectory
Netiq
1 product
Edirectory
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Edirectory
Up to 8.8.8
Netiq
Edirectory
Version 8.8.8 patch10
Edirectory
Version 8.8.8 patch5
Edirectory
Version 8.8.8 patch6
Edirectory
Version 8.8.8 patch7
Edirectory
Version 8.8.8 patch8
Edirectory
Version 8.8.8 patch9

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
CWE-434
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (6)

Source: security@opentext.com
Source: security@opentext.com
Source: security@opentext.com
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.