CVE-2017-9393 - Vulnerability Details

Vendors	Products
Ca	Identity Manager Identity Manager Virtual Appliance

Link	Providers
http://www.securityfocus.com/bid/100956
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Identity Manager", "vendor": "CA Technologies", "versions": [{"status": "affected", "version": "12.6 through 12.6 SP8"}, {"status": "affected", "version": "14.0"}, {"status": "affected", "version": "14.1"}]}], "datePublic": "2017-09-21T00:00:00", "descriptions": [{"lang": "en", "value": "CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-23T09:57:01", "orgId": "e291eae9-7c0a-46ac-ba7d-5251811f8b7f", "shortName": "ca"}, "references": [{"name": "100956", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100956"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vuln@ca.com", "DATE_PUBLIC": "2017-09-21T00:00:00", "ID": "CVE-2017-9393", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Identity Manager", "version": {"version_data": [{"version_value": "12.6 through 12.6 SP8"}, {"version_value": "14.0"}, {"version_value": "14.1"}]}}]}, "vendor_name": "CA Technologies"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "100956", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100956"}, {"name": "https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html", "refsource": "CONFIRM", "url": "https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T17:02:44.383Z"}, "title": "CVE Program Container", "references": [{"name": "100956", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/100956"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html"}]}]}, "cveMetadata": {"assignerOrgId": "e291eae9-7c0a-46ac-ba7d-5251811f8b7f", "assignerShortName": "ca", "cveId": "CVE-2017-9393", "datePublished": "2017-09-22T14:00:00Z", "dateReserved": "2017-06-02T00:00:00", "dateUpdated": "2024-09-17T03:02:02.761Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Identity Manager (string)

vendor : CA Technologies (string)

versions : [ »

0 : { »

status : affected (string)

version : 12.6 through 12.6 SP8 (string)

}

1 : { »

status : affected (string)

version : 14.0 (string)

}

2 : { »

status : affected (string)

version : 14.1 (string)

}

]

}

]

datePublic : 2017-09-21T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Information Disclosure (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-09-23T09:57:01 (string)

orgId : e291eae9-7c0a-46ac-ba7d-5251811f8b7f (string)

shortName : ca (string)

}

references : [ »

0 : { »

name : 100956 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/100956 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : vuln@ca.com (string)

DATE_PUBLIC : 2017-09-21T00:00:00 (string)

ID : CVE-2017-9393 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Identity Manager (string)

version : { »

version_data : [ »

0 : { »

version_value : 12.6 through 12.6 SP8 (string)

}

1 : { »

version_value : 14.0 (string)

}

2 : { »

version_value : 14.1 (string)

}

]

}

]

}

vendor_name : CA Technologies (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Information Disclosure (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : 100956 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/100956 (string)

}

1 : { »

name : https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html (string)

refsource : CONFIRM (string)

url : https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T17:02:44.383Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 100956 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/100956 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : e291eae9-7c0a-46ac-ba7d-5251811f8b7f (string)

assignerShortName : ca (string)

cveId : CVE-2017-9393 (string)

datePublished : 2017-09-22T14:00:00Z (string)

dateReserved : 2017-06-02T00:00:00 (string)

dateUpdated : 2024-09-17T03:02:02.761Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ca:identity_manager:12.6:ga:*:*:*:*:*:*", "matchCriteriaId": "BC40E880-CBE1-401D-AC52-ABD8AA5BA532", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:12.6:sp1:*:*:*:*:*:*", "matchCriteriaId": "29BC5F88-A884-4F5E-9D04-34C73B7A2CB5", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:12.6:sp2:*:*:*:*:*:*", "matchCriteriaId": "18C26D26-5ACC-489E-88BA-25A0008CA2F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:12.6:sp3:*:*:*:*:*:*", "matchCriteriaId": "FC189A1D-4508-466A-9116-99EF52A2BB17", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:12.6:sp4:*:*:*:*:*:*", "matchCriteriaId": "73F4AC0A-5F43-4000-A414-99964CB404CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:12.6:sp5:*:*:*:*:*:*", "matchCriteriaId": "3478DC20-8307-4DA8-B922-5A995BDE233C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:12.6:sp6:*:*:*:*:*:*", "matchCriteriaId": "97628548-6314-4A4F-AA5B-7FCCBA168150", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:12.6:sp7:*:*:*:*:*:*", "matchCriteriaId": "BD363ACE-7E26-430B-AA6A-1AE1BF4C5142", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:12.6:sp8:*:*:*:*:*:*", "matchCriteriaId": "CC53B461-E09D-45C3-8CB8-CEAA69FF6A4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:14.0:*:*:*:*:*:*:*", "matchCriteriaId": "FDB09257-D88D-417A-B734-7AF24889D46B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager:14.1:*:*:*:*:*:*:*", "matchCriteriaId": "D2D6060C-BF65-45E3-91F5-D3AAC4305ACC", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager_virtual_appliance:14.0:*:*:*:*:*:*:*", "matchCriteriaId": "C494D3D0-0351-40BC-AA45-54F1272250A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ca:identity_manager_virtual_appliance:14.1:*:*:*:*:*:*:*", "matchCriteriaId": "416D96F6-1BB4-4F0C-A75C-0E88968FC0B7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search."}, {"lang": "es", "value": "CA Identity Manager de la versi\u00f3n r12.6 a la r12.6 SP8, 14.0 y 14.1 permite que los atacantes remotos identifiquen contrase\u00f1as de cuentas bloqueadas mediante una b\u00fasqueda exhaustiva."}], "id": "CVE-2017-9393", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-22T14:29:00.273", "references": [{"source": "vuln@ca.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100956"}, {"source": "vuln@ca.com", "tags": ["Vendor Advisory"], "url": "https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100956"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html"}], "sourceIdentifier": "vuln@ca.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:ga:*:*:*:*:*:* (string)

matchCriteriaId : BC40E880-CBE1-401D-AC52-ABD8AA5BA532 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:sp1:*:*:*:*:*:* (string)

matchCriteriaId : 29BC5F88-A884-4F5E-9D04-34C73B7A2CB5 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:sp2:*:*:*:*:*:* (string)

matchCriteriaId : 18C26D26-5ACC-489E-88BA-25A0008CA2F3 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:sp3:*:*:*:*:*:* (string)

matchCriteriaId : FC189A1D-4508-466A-9116-99EF52A2BB17 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:sp4:*:*:*:*:*:* (string)

matchCriteriaId : 73F4AC0A-5F43-4000-A414-99964CB404CD (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:sp5:*:*:*:*:*:* (string)

matchCriteriaId : 3478DC20-8307-4DA8-B922-5A995BDE233C (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:sp6:*:*:*:*:*:* (string)

matchCriteriaId : 97628548-6314-4A4F-AA5B-7FCCBA168150 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:sp7:*:*:*:*:*:* (string)

matchCriteriaId : BD363ACE-7E26-430B-AA6A-1AE1BF4C5142 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:ca:identity_manager:12.6:sp8:*:*:*:*:*:* (string)

matchCriteriaId : CC53B461-E09D-45C3-8CB8-CEAA69FF6A4E (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:ca:identity_manager:14.0:*:*:*:*:*:*:* (string)

matchCriteriaId : FDB09257-D88D-417A-B734-7AF24889D46B (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:ca:identity_manager:14.1:*:*:*:*:*:*:* (string)

matchCriteriaId : D2D6060C-BF65-45E3-91F5-D3AAC4305ACC (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:ca:identity_manager_virtual_appliance:14.0:*:*:*:*:*:*:* (string)

matchCriteriaId : C494D3D0-0351-40BC-AA45-54F1272250A8 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:ca:identity_manager_virtual_appliance:14.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 416D96F6-1BB4-4F0C-A75C-0E88968FC0B7 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search. (string)

}

1 : { »

lang : es (string)

value : CA Identity Manager de la versión r12.6 a la r12.6 SP8, 14.0 y 14.1 permite que los atacantes remotos identifiquen contraseñas de cuentas bloqueadas mediante una búsqueda exhaustiva. (string)

}

]

id : CVE-2017-9393 (string)

lastModified : 2025-04-20T01:37:25.860 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : true (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-09-22T14:29:00.273 (string)

references : [ »

0 : { »

source : vuln@ca.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/100956 (string)

}

1 : { »

source : vuln@ca.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/100956 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html (string)

}

]

sourceIdentifier : vuln@ca.com (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-200 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object