CVE-2017-7431 Cross-site request forgery in Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1
Persistent CSRF in object management allows attackers to perform unauthorized actions on behalf of authenticated users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-7431?
CVE-2017-7431 is a high-severity vulnerability in Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1, published on 3 May 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management.
Weakness: CWE-352
Which versions are affected by CVE-2017-7431?
It affects 2 products.
Products include Netiq Imanager, Novell Imanager.
How do I fix CVE-2017-7431?
No fix has been published for CVE-2017-7431 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-7431 being exploited?
There is no known exploitation of CVE-2017-7431 in the wild and no public exploit code.
Other vulnerabilities in Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1
- CVE-2017-7432 File upload in Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1
- CVE-2017-7425 Multiple Reflected XSS in iManager
- CVE-2022-38758 XSS vulnerabilities in iManager
- CVE-2017-7430 Cross-site scripting in Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1
- CVE-2018-1345 iManager elevation of privilege
Sources
Also known as GHSA-qwvv-8h5h-p3cc.