CVE-2017-7427 - CVE House
Back to Database
Status published Medium CVE-2017-7427

iManager - Multiple Reflected Cross-Site Scripting attacks

Vulnerability Description

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector, via vdtData in the Version discovery and via nextFrame in the Object Inspector and via Host GUID in the System details plugins.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-7427

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Pawel.Batunek@ingservicespolska.pl

References

More from NetIQ

View All →
CVE-2018-7678
XSS vulnerability in NetIQ Access Manager (NAM) Admin Console component
Low 3.5
CVE-2018-7677
CSRF in NetIQ Access Manager (NAM) Identity Server component
Low 3.5
CVE-2018-7676
IDM Information Leakage
Low 3.9
CVE-2018-7674
IDM URL Redirection attack
Low 2.1
CVE-2018-7673
NetIQ Identity Manager DoS Attack
Medium 5.1

Affected Vendor

Affected Software

Identity Manager
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 5th, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact