CVE-2017-9278 Avoid password disclosure via EBS event logging in the iManager Oracle driver
Attackers with read access to EBS tables can obtain the driver authentication password due to improper logging in the NetIQ Identity Manager Oracle EBS driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9278?
CVE-2017-9278 is a low-severity vulnerability in NetIQ Identity Manager Oracle EBS driver, published on 2 Mar 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the EBS tables.
Weakness: CWE-532
Which versions are affected by CVE-2017-9278?
It affects 1 product.
Products include Netiq Identity Manager.
How do I fix CVE-2017-9278?
No fix has been published for CVE-2017-9278 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-9278 being exploited?
There is no known exploitation of CVE-2017-9278 in the wild and no public exploit code.
Other vulnerabilities in NetIQ Identity Manager Oracle EBS driver
- CVE-2006-4803 Code injection in n/a
- CVE-2015-0787 Cross-site scripting in NetIQ Designer for Identity Manager before 4.5.3
- CVE-2016-1592 Cross-site scripting in NetIQ Designer for Identity Manager before 4.5.3
- CVE-2017-7427 iManager - Multiple Reflected Cross-Site Scripting attacks
- CVE-2017-7426 iManager - XML External Entity vulnerabilities
Sources
Also known as GHSA-cxvc-pvrc-8c3g.