CVE-2017-14803 Code injection in NetIQ Access Manager
An attacker can execute arbitrary code on the system by exploiting a bug in the Identity Server when accessing a basic SSO connector.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-14803?
CVE-2017-14803 is a critical code injection vulnerability in Micro Focus NetIQ Access Manager, published on 20 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system.
Which versions are affected by CVE-2017-14803?
It affects 1 product.
Products include Netiq Access Manager.
How do I fix CVE-2017-14803?
No fix has been published for CVE-2017-14803 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-14803 being exploited?
There is no known exploitation of CVE-2017-14803 in the wild and no public exploit code.
Other vulnerabilities in Micro Focus NetIQ Access Manager
- CVE-2018-1342 File upload in NetIQ Access Manager, Administrative Console
- CVE-2016-5757 Information disclosure in NetIQ Access Manager
- CVE-2016-5750 File upload in NetIQ iManager
- CVE-2016-5758 Cross-site request forgery in NetIQ Access Manager
- CVE-2016-5752 Information disclosure in NetIQ Access Manager
Sources
Also known as GHSA-w8wj-w6xx-2wp8.