PT-2014-6351 · Netiq · Netiq Access Manager

Published 2014-12-23 · Updated 2021-04-09 · CVE-2014-5215

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager (NAM) versions 4.0.0 through 4.0.1 before HF3

Description The issue allows remote authenticated administrators to discover service-account passwords. This can be achieved by sending a request to API endpoints such as "roma/jsp/volsc/monitoring/dev services.jsp" or "roma/jsp/debug/debug.jsp".

Recommendations For versions 4.0.0 through 4.0.1 before HF3, update to version 4.0.1 HF3 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-5215

Affected Products

Netiq Access Manager

References · 5

• 🔥 http://seclists.org/fulldisclosure/2014/Dec/78 · Exploit
• 🔥 http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html · Exploit
• 🔥 https://novell.com/support/kb/doc.php?id=7015995 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5215 · Security Note