CVE-2012-5930

The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://download.novell.com/Download?buildid=K6-PmbPjduA~
http://retrogod.altervista.org/9sg_novell_netiq_i.htm	Exploit
http://retrogod.altervista.org/9sg_novell_netiq_i_adv.htm	Exploit
https://www.netiq.com/support/kb/doc.php?id=7011385	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microfocus:privileged_user_manager:2.3.0:::::::*
	cpe:2.3:a:microfocus:privileged_user_manager:2.3.1:::::::*

History

13 Apr 2021, 16:46

Type	Values Removed	Values Added
CPE	cpe:2.3:a:netiq:privileged_user_manager:2.3.0:::::::* cpe:2.3:a:netiq:privileged_user_manager:2.3.1:::::::*	cpe:2.3:a:microfocus:privileged_user_manager:2.3.1:::::::* cpe:2.3:a:microfocus:privileged_user_manager:2.3.0:::::::*

Information

Published : 2012-12-24 18:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-5930

Mitre link : CVE-2012-5930

CVE.ORG link : CVE-2012-5930

JSON object : View

Products Affected

microfocus

privileged_user_manager

CWE

CWE-287

Improper Authentication

{"id": "CVE-2012-5930", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-12-24T18:55:02.337", "references": [{"url": "http://download.novell.com/Download?buildid=K6-PmbPjduA~", "source": "cve@mitre.org"}, {"url": "http://retrogod.altervista.org/9sg_novell_netiq_i.htm", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://retrogod.altervista.org/9sg_novell_netiq_i_adv.htm", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://www.netiq.com/support/kb/doc.php?id=7011385", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request."}, {"lang": "es", "value": "La funci\u00f3n pa_modify_accounts en auth.dll en unifid.exe en NetIQ Privileged User Manager v2.3.x antes de v2.3.1 HF2 no requiere autenticaci\u00f3n para el m\u00e9todo modifyAccounts, lo que permite a atacantes remotos cambiar las contrase\u00f1as de cuentas administrativas a trav\u00e9s de una petici\u00f3n application/x-amf hecha a mano.\r\n"}], "lastModified": "2021-04-13T16:46:07.407", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microfocus:privileged_user_manager:2.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2902077-EE48-49F3-92C7-F27F843C5148"}, {"criteria": "cpe:2.3:a:microfocus:privileged_user_manager:2.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "477A0628-E118-4595-9E59-BFACB94D953F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}