CVE-2016-5752 The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially maliciou...
HighCVSS 7.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netiq access manager | = 4.1 | No fix listed |
| netiq access manager | = 4.1-sp1 | No fix listed |
| netiq access manager | = 4.1-sp2 | No fix listed |
| netiq access manager | = 4.2 | No fix listed |
| netiq access manager | = 4.2-sp1 | No fix listed |