CVE-2018-7673 NetIQ Identity Manager DoS Attack
Attackers can cause a denial of service in NetIQ Identity Manager via its communication channel, affecting service availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7673?
CVE-2018-7673 is a medium-severity denial of service vulnerability in NetIQ Identity Manager, published on 26 Mar 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack.
Which versions are affected by CVE-2018-7673?
It affects 1 product.
Products include Netiq Identity Manager.
How do I fix CVE-2018-7673?
No fix has been published for CVE-2018-7673 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-7673 being exploited?
There is no known exploitation of CVE-2018-7673 in the wild and no public exploit code.
Other vulnerabilities in NetIQ Identity Manager
- CVE-2006-4803 Code injection in n/a
- CVE-2015-0787 Cross-site scripting in NetIQ Designer for Identity Manager before 4.5.3
- CVE-2016-1592 Cross-site scripting in NetIQ Designer for Identity Manager before 4.5.3
- CVE-2017-7427 iManager - Multiple Reflected Cross-Site Scripting attacks
- CVE-2017-7426 iManager - XML External Entity vulnerabilities
Sources
Also known as GHSA-6wc4-c7m9-9699.