CVE-2017-5183 NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document.
MediumCVSS 6.1
EPSS 0.67%
- Published
- Updated
- Exploit status
- No public exploit known
Description
NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netiq access manager | = 4.2.2 | No fix listed |
| netiq access manager | = 4.3 | No fix listed |
| netiq access manager | = 4.3.1 | No fix listed |