PT-2014-8997 · Netiq · Netiq Access Manager

Published 2014-12-23 · Updated 2021-04-09 · CVE-2014-9412

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions prior to 4.1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via an arbitrary parameter to "roma/jsp/debug/debug.jsp" or an arbitrary parameter in a debug.DumpAll action to "nps/servlet/webacc".

Recommendations For versions prior to 4.1, update to version 4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "roma/jsp/debug/debug.jsp" and "nps/servlet/webacc" endpoints until a patch is available. Avoid using arbitrary parameters in the debug.DumpAll action until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9412

Affected Products

Netiq Access Manager

References · 6

• 🔥 http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html · Exploit
• 🔥 https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt · Exploit
• 🔥 https://novell.com/support/kb/doc.php?id=7015994 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Dec/78 · Exploit
• 🔥 https://exploit-db.com/exploits/35594 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9412 · Security Note