CVE-2014-5217 Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentica...
MediumCVSS 6.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| microfocus access manager | = 4.0 | No fix listed |
| microfocus access manager | = 4.0.1 | No fix listed |
References
- packetstormsecurity.com exploit
- 20141218 SEC Consult SA-20141218-2 :: Multiple high risk vulnerabilities in NetIQ Access Manager exploit mailing-list
- www.novell.com exploit vendor-advisory
- www.sec-consult.com exploit