PT-2018-8376 · Micro Focus · Imanager+1

Published 2018-03-05 · Updated 2019-10-09 · CVE-2017-7427

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions iManager version 2.7.7.7 Identity Manager versions prior to 4.6.1

Description The issue allows for multiple cross-site scripting attacks in certain scenarios, enabling the execution of arbitrary JavaScript code in the context of the vulnerable application. This can occur via the user.Context in the Object Selector, vdtData in the Version discovery, nextFrame in the Object Inspector, and Host GUID in the System details plugins.

Recommendations For iManager version 2.7.7.7, update to a version that includes the fix for this issue. For Identity Manager versions prior to 4.6.1, update to version 4.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Object Selector, Version discovery, Object Inspector, and System details plugins until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-7427

Affected Products

Identity Manager

Imanager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-7427 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7427 · Vendor Advisory
• https://novell.com/support/kb/doc.php?id=7021423 · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1033828 · Note