CVE-2017-7419

NetIQ Access Manager OAuth Consent screen XSS attack

State: Published
Severity: 4.6 Medium
Published: Mar 2, 2018
Updated: Sep 16, 2024
Reserved: Apr 5, 2017

Description

A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider.

Scores

CVSS	Score	Vector	Source
3.0	4.6 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N	microfocus

Weaknesses

CWE-79

Affected Products

Product	Versions
Access ManagerNetIQ	4.3 to before 4.3.2Affected 4.2 to before 4.2.4Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=1031853
https://www.novell.com/support/kb/doc.php?id=7019893

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.