CVE-2014-5216 Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a...
MediumCVSS 4.3
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc, (2) the error parameter to nidp/jsp/x509err.jsp, (3) the lang parameter to sslvpn/applet_agent.jsp, or (4) the secureLoggingServersA parameter to roma/system/cntl, a different issue than CVE-2014-9412.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microfocus access manager | = 4.0 | No fix listed |
| microfocus access manager | = 4.0.1 | No fix listed |
References
- packetstormsecurity.com exploit
- 20141218 SEC Consult SA-20141218-2 :: Multiple high risk vulnerabilities in NetIQ Access Manager exploit mailing-list
- www.novell.com exploit vendor-advisory
- www.novell.com exploit vendor-advisory
- www.sec-consult.com exploit