Lucene search

MicrofocusCVE-2016-1598

HistoryOct 27, 2016 - 8:59 p.m.

CVE-2016-1598

2016-10-2720:59:04

CWE-79

microfocus

web.nvd.nist.gov

cve-2016-1598

xss

netiq

idm

identity applications

html injection

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into the Role Assignment administrator HTML pages.

Affected configurations

Nvd

Node

novellidentity_managerMatch4.5

novellidentity_manager_identity_applicationsRange≤4.5.3

VendorProductVersionCPE
novellidentity_manager4.5cpe:2.3:a:novell:identity_manager:4.5:*:*:*:*:*:*:*
novellidentity_manager_identity_applications*cpe:2.3:a:novell:identity_manager_identity_applications:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
novell	identity_manager	4.5	cpe:2.3:a:novell:identity_manager:4.5:::::::*
novell	identity_manager_identity_applications	*	cpe:2.3:a:novell:identity_manager_identity_applications::::::::

CNA Affected

[
  {
    "product": "NetIQ IDM 4.5 Identity Applications before 4.5.4",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "NetIQ IDM 4.5 Identity Applications before 4.5.4"
      }
    ]
  }
]

References

www.securityfocus.com/bid/93833

download.novell.com/Download?buildid=xyswDCMsT7I~

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

Related for CVE-2016-1598