PT-2018-8501 · Netiq · Netiq Identity Manager

Publicado 2018-03-02 · Atualizado 2019-10-09 · CVE-2017-9279

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetIQ Identity Manager versions prior to 4.5.6.1

Description The issue allows malicious user administrators to upload files with double extensions or non-image content in the Themes handling of the User Application Administration. This could potentially lead to code execution or misleading users.

Recommendations For versions prior to 4.5.6.1, update to version 4.5.6.1 or later to resolve the issue. As a temporary workaround, consider restricting file uploads in the User Application Administration to minimize the risk of exploitation.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-20

CWE-434

Identificadores relacionados

CVE-2017-9279

Produtos afetados

Netiq Identity Manager

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-9279 · Nota de Segurança
• https://bugzilla.suse.com/show_bug.cgi?id=1049129 · Nota
• https://osv.dev/vulnerability/CVE-2017-9279 · Aviso do Fabricante
• https://download.novell.com/Download?buildid=K7lbPAGJyIk~ · Nota