CVE-2017-7437

Published: Mar 5, 2018Modified: Nov 21, 2024

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests.

Affected (4)

Products: Netiq: Privileged Account Manager

Netiq

1 product

Privileged Account Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Netiq Privileged Account Manager	Up to 3.0
Netiq Privileged Account Manager	Version 3.1
Netiq Privileged Account Manager	Version 3.1 hotfix1
Netiq Privileged Account Manager	Version 3.1 hotfix2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://bugzilla.suse.com/show_bug.cgi?id=1001069

Source: security@opentext.com

https://www.netiq.com/documentation/privileged-account-manager-3/npam3103-release-notes/data/npam3103-release-notes.html

Source: security@opentext.com

https://bugzilla.suse.com/show_bug.cgi?id=1001069

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.netiq.com/documentation/privileged-account-manager-3/npam3103-release-notes/data/npam3103-release-notes.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.