PT-2014-6352 · Netiq · Netiq Access Manager

W. Ettlinger · Published 2014-12-23 · Updated 2021-04-09 · CVE-2014-5216

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions prior to 4.0.1 HF3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in various API endpoints, including:

• the location parameter in a dev.Empty action to "nps/servlet/webacc"
• the error parameter to "nidp/jsp/x509err.jsp"
• the lang parameter to "sslvpn/applet agent.jsp"
• the secureLoggingServersA parameter to "roma/system/cntl"

Recommendations For versions prior to 4.0.1 HF3, update to version 4.0.1 HF3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is applied. Avoid using the vulnerable parameters in the affected endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-5216

Affected Products

Netiq Access Manager

References · 7

• 🔥 http://seclists.org/fulldisclosure/2014/Dec/78 · Exploit
• 🔥 https://exploit-db.com/exploits/35594 · Exploit
• 🔥 https://novell.com/support/kb/doc.php?id=7015994 · Exploit
• 🔥 http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html · Exploit
• 🔥 https://novell.com/support/kb/doc.php?id=7015996 · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5216 · Security Note