CVE-2017-9280

Novell Identity Manager User Application get request url contains the session token.

State: Published
Severity: 4.3 Medium
Published: Mar 2, 2018
Updated: Sep 16, 2024
Reserved: May 29, 2017

Description

Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar.

Scores

CVSS	Score	Vector	Source
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	microfocus

Weaknesses

CWE-598

Affected Products

Product	Versions
Identity Manager ApplicationsNetIQ	before 4.5.6.1Affected

References

https://download.novell.com/Download?buildid=K7lbPAGJyIk~
https://bugzilla.suse.com/show_bug.cgi?id=1049143

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.