PT-2017-8765 · Netiq · Netiq Access Manager

Published 2017-03-23 · Updated 2017-03-24 · CVE-2016-5756

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.1 through 4.1.2 before Hot Fix 1 NetIQ Access Manager versions 4.2 through 4.2.2

Description The issue allows for Reflected Cross Site Scripting attacks, which could be used to hijack user sessions. The affected API endpoints include "nps/servlet/frameservice", "nps/servlet/webacc", "roma/admin/cntl", "roma/jsp/admin/appliance/devicedetail edit.jsp", "roma/jsp/admin/managementip/mgmt ip details frameset.jsp", "roma/jsp/admin/managementip/mgmt ip details middleframe.jsp", "roma/jsp/volsc/monitoring/appliance.jsp", and "roma/jsp/volsc/monitoring/graph.jsp".

Recommendations For NetIQ Access Manager versions 4.1 through 4.1.2 before Hot Fix 1, update to version 4.1.2 Hot Fix 1 to resolve the issue. For NetIQ Access Manager versions 4.2 through 4.2.2, update to version 4.2.2 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-5756

Affected Products

Netiq Access Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-5756 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5756 · Vendor Advisory
• https://novell.com/support/kb/doc.php?id=7017813 · Note