CVE-2017-7427 MEDIUM

CVE-2017-7427: iManager - Multiple Reflected Cross-Site Scripting attacks

Vendor Netiq
Product Identity Manager
Weakness CWE-79 · XSS
Published March 5, 2018
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector, via vdtData in the Version discovery and via nextFrame in the Object Inspector and via Host GUID in the System details plugins.

Key dates

02Disclosure timeline

March 5, 2018 CVE published
September 17, 2024 Record updated