CVE-2017-5190 - Vulnerability Details - OpenCVE

Description

NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile.

Published: 2017-04-20

Score: 3.1 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

NAM Identity Server and SAML2 Service Provider

affected

Version	Status	Constraints
`NAM Identity Server and SAML2 Service Provider`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:netiq:access_manager::sp3::::::*
	cpe:2.3:a:netiq:access_manager::sp1::::::*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2017-14299	NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00236.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.securityfocus.com/bid/97965
http://www.securitytracker.com/id/1038338
https://www.novell.com/support/kb/doc.php?id=7018792

History

No history.

Subscriptions

Netiq Access Manager

MITRE

Status: PUBLISHED

Assigner: microfocus

Published: 2017-04-20T15:00:00.000Z

Updated: 2024-08-05T14:55:35.383Z

Reserved: 2017-01-06T00:00:00.000Z

Link: CVE-2017-5190

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-04-20T15:59:00.170

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-5190

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-200

{"containers": {"cna": {"affected": [{"product": "NAM Identity Server and SAML2 Service Provider", "vendor": "n/a", "versions": [{"status": "affected", "version": "NAM Identity Server and SAML2 Service Provider"}]}], "datePublic": "2017-04-20T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile."}], "problemTypes": [{"descriptions": [{"description": "Information leakage", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-01-06T16:15:28.000Z", "orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "microfocus"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.novell.com/support/kb/doc.php?id=7018792"}, {"name": "97965", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/97965"}, {"name": "1038338", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038338"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@microfocus.com", "ID": "CVE-2017-5190", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NAM Identity Server and SAML2 Service Provider", "version": {"version_data": [{"version_value": "NAM Identity Server and SAML2 Service Provider"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information leakage"}]}]}, "references": {"reference_data": [{"name": "https://www.novell.com/support/kb/doc.php?id=7018792", "refsource": "CONFIRM", "url": "https://www.novell.com/support/kb/doc.php?id=7018792"}, {"name": "97965", "refsource": "BID", "url": "http://www.securityfocus.com/bid/97965"}, {"name": "1038338", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038338"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T14:55:35.383Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.novell.com/support/kb/doc.php?id=7018792"}, {"name": "97965", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/97965"}, {"name": "1038338", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038338"}]}]}, "cveMetadata": {"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "assignerShortName": "microfocus", "cveId": "CVE-2017-5190", "datePublished": "2017-04-20T15:00:00.000Z", "dateReserved": "2017-01-06T00:00:00.000Z", "dateUpdated": "2024-08-05T14:55:35.383Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netiq:access_manager:*:sp3:*:*:*:*:*:*", "matchCriteriaId": "91FB806C-6B3A-4FE3-924F-2F016B34314B", "versionEndIncluding": "4.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:netiq:access_manager:*:sp1:*:*:*:*:*:*", "matchCriteriaId": "11A7ED20-D0BC-4FE9-B1AF-8FE9C53CA631", "versionEndIncluding": "4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile."}, {"lang": "es", "value": "NetIQ Access Manager 4.2 en versiones anteriores a SP3 HF1 y 4.3 en versiones anteriores a SP1 HF1 cuando est\u00e1 configurado como un SAML 2.0 Identity Server con Virtual Attributes, tiene un problema de concurrencia causando la fuga de informaci\u00f3n, relacionado con un perfil obsoleto."}], "id": "CVE-2017-5190", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-20T15:59:00.170", "references": [{"source": "security@opentext.com", "url": "http://www.securityfocus.com/bid/97965"}, {"source": "security@opentext.com", "url": "http://www.securitytracker.com/id/1038338"}, {"source": "security@opentext.com", "url": "https://www.novell.com/support/kb/doc.php?id=7018792"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/97965"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1038338"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.novell.com/support/kb/doc.php?id=7018792"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}