CVE-2017-7426 iManager - XML External Entity vulnerabilities
Attackers can exploit XML External Entity flaws in NetIQ Identity Manager Plugins to leak sensitive information or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-7426?
CVE-2017-7426 is a medium-severity vulnerability in NetIQ Identity Manager Plug-ins, published on 1 Mar 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak information or cause denial of service attacks.
Weakness: CWE-611
Which versions are affected by CVE-2017-7426?
It affects 1 product.
Products include Netiq Identity Manager.
How do I fix CVE-2017-7426?
No fix has been published for CVE-2017-7426 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-7426 being exploited?
There is no known exploitation of CVE-2017-7426 in the wild and no public exploit code.
Other vulnerabilities in NetIQ Identity Manager Plug-ins
- CVE-2006-4803 Code injection in n/a
- CVE-2015-0787 Cross-site scripting in NetIQ Designer for Identity Manager before 4.5.3
- CVE-2016-1592 Cross-site scripting in NetIQ Designer for Identity Manager before 4.5.3
- CVE-2017-7427 iManager - Multiple Reflected Cross-Site Scripting attacks
- CVE-2018-1348 NetIQ Identity Manager SSL Renegotiation
Sources
Also known as GHSA-q876-xvxf-r2h2.