CVE-2014-5217

Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html	Exploit
http://seclists.org/fulldisclosure/2014/Dec/78	Exploit
https://www.novell.com/support/kb/doc.php?id=7015997	Exploit Vendor Advisory
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microfocus:access_manager:4.0:::::::*
	cpe:2.3:a:microfocus:access_manager:4.0.1:::::::*

History

09 Apr 2021, 16:36

Type	Values Removed	Values Added
CPE	cpe:2.3:a:netiq:access_manager:4.0:::::::* cpe:2.3:a:netiq:access_manager:4.0.1:::::::*	cpe:2.3:a:microfocus:access_manager:4.0:::::::* cpe:2.3:a:microfocus:access_manager:4.0.1:::::::*

Information

Published : 2014-12-23 11:59

Updated : 2023-12-10 11:31

NVD link : CVE-2014-5217

Mitre link : CVE-2014-5217

CVE.ORG link : CVE-2014-5217

JSON object : View

Products Affected

microfocus

access_manager

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2014-5217", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-12-23T11:59:03.157", "references": [{"url": "http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2014/Dec/78", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://www.novell.com/support/kb/doc.php?id=7015997", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action."}, {"lang": "es", "value": "Vulnerabilidad de CSRF en nps/servlet/webacc en el servidor Administration Console en NetIQ Access Manager (NAM) 4.x anterior a 4.1 permite a atacantes remotos secuestrar la autenticaci\u00f3n de los administradores para peticiones que cambian la contrase\u00f1a administrativa mediante una acci\u00f3n fw.SetPassword."}], "lastModified": "2021-04-09T16:36:15.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microfocus:access_manager:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35DFCCD1-47A2-4149-95C7-4D6E21F0F1FE"}, {"criteria": "cpe:2.3:a:microfocus:access_manager:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15D93F2E-FD9D-4A00-B0BF-A5863A6B1852"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}