CVE-2018-17950 Missing authorization in NetIQ eDirectory 9.1 SP2

What is CVE-2018-17950?

CVE-2018-17950 is a high-severity missing authorization vulnerability in Micro Focus NetIQ eDirectory 9.1 SP2, published on 12 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2

Weakness: CWE-863

Which versions are affected by CVE-2018-17950?

It affects 1 product.

Products include Microfocus Edirectory.

How do I fix CVE-2018-17950?

No fix has been published for CVE-2018-17950 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-17950 being exploited?

There is no known exploitation of CVE-2018-17950 in the wild and no public exploit code.

Other vulnerabilities in Micro Focus NetIQ eDirectory 9.1 SP2

• CVE-2012-0432 Memory corruption in n/a Critical 10.0
• CVE-2017-7429 Fix for NetIQ shell code upload High 8.8
• CVE-2021-22532 Possible NLDAP Denial of Service attack Vulnerability High 7.6
• CVE-2018-7686 Information disclosure in eDirectory (ZDI) High 7.5
• CVE-2021-38133 Possible Improper authentication Vulnerability in OpenText eDirectory High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j6h7-3pc4-2m8j.