CVE-2018-7678

XSS vulnerability in NetIQ Access Manager (NAM) Admin Console component

View on CVE.org

Published Mar 14, 2018 CVSS 3.0 · 3.5 Low EPSS < 1% KEV · Not listed

Description

A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.

Analysis

No analysis available yet

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NetIQ

NetIQ Access Manager (NAM) Admin Console

affected

Version	Status	Constraints
`Access Manager 4.4`	affected	—
`Access Manager 4.3`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:netiq:access_manager:4.3:::::::*
	cpe:2.3:a:netiq:access_manager:4.4:::::::*

No data.

No data available yet.

Remediation

Vendor Solution

Apply 4.4 SP1.

Vendor Workaround

Apply 4.4 SP1.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2018-19394	A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4.

Metrics

No CVSS v4.0

No CVSS v3.1

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.609% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.securityfocus.com/bid/103421
https://www.netiq.com/support/kb/doc.php?id=7022724

History

No history.

Subscriptions

Netiq Access Manager

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

CVE record Updated: Aug 5, 2024, 6:31 AM

Status: PUBLISHED
Assigner: microfocus
Published: Mar 14, 2018, 3:00 PM
Updated: Aug 5, 2024, 6:31 AM
Reserved: Mar 5, 2018, 12:00 AM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Jun 17, 2026, 2:03 AM

Status: Modified
Published: Mar 14, 2018, 3:29 PM
Modified: Jun 17, 2026, 2:03 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"containers": {"cna": {"affected": [{"product": "NetIQ Access Manager (NAM) Admin Console", "vendor": "NetIQ", "versions": [{"status": "affected", "version": "Access Manager 4.4"}, {"status": "affected", "version": "Access Manager 4.3"}]}], "datePublic": "2018-03-12T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "XSS", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-01-06T16:16:07.000Z", "orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "microfocus"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.netiq.com/support/kb/doc.php?id=7022724"}, {"name": "103421", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/103421"}], "solutions": [{"lang": "en", "value": "Apply 4.4 SP1."}], "source": {"advisory": "https://www.netiq.com/support/kb/doc.php?id=7022724", "defect": ["XSS", "vulnerability"], "discovery": "INTERNAL"}, "title": "XSS vulnerability in NetIQ Access Manager (NAM) Admin Console component", "workarounds": [{"lang": "en", "value": "Apply 4.4 SP1."}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@microfocus.com", "ID": "CVE-2018-7678", "STATE": "PUBLIC", "TITLE": "XSS vulnerability in NetIQ Access Manager (NAM) Admin Console component"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NetIQ Access Manager (NAM) Admin Console", "version": {"version_data": [{"affected": "=", "version_affected": "=", "version_name": "Access Manager", "version_value": "4.4"}, {"affected": "=", "version_affected": "=", "version_name": "Access Manager", "version_value": "4.3"}]}}]}, "vendor_name": "NetIQ"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "XSS"}]}]}, "references": {"reference_data": [{"name": "https://www.netiq.com/support/kb/doc.php?id=7022724", "refsource": "CONFIRM", "url": "https://www.netiq.com/support/kb/doc.php?id=7022724"}, {"name": "103421", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103421"}]}, "solution": [{"lang": "en", "value": "Apply 4.4 SP1."}], "source": {"advisory": "https://www.netiq.com/support/kb/doc.php?id=7022724", "defect": ["XSS", "vulnerability"], "discovery": "INTERNAL"}, "work_around": [{"lang": "en", "value": "Apply 4.4 SP1."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:31:05.113Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.netiq.com/support/kb/doc.php?id=7022724"}, {"name": "103421", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/103421"}]}]}, "cveMetadata": {"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "assignerShortName": "microfocus", "cveId": "CVE-2018-7678", "datePublished": "2018-03-14T15:00:00.000Z", "dateReserved": "2018-03-05T00:00:00.000Z", "dateUpdated": "2024-08-05T06:31:05.113Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "NetIQ Access Manager (NAM) Admin Console", "vendor": "NetIQ", "versions": [{"status": "affected", "version": "Access Manager 4.4"}, {"status": "affected", "version": "Access Manager 4.3"}]}], "source": "security@opentext.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netiq:access_manager:4.3:*:*:*:*:*:*:*", "matchCriteriaId": "51430A7A-F79D-445D-ABF8-A8B4ADE98FC3", "vulnerable": true}, {"criteria": "cpe:2.3:a:netiq:access_manager:4.4:*:*:*:*:*:*:*", "matchCriteriaId": "36A890D3-618E-4060-9349-36BA7F7B4240", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Scripting (XSS) en la consola de administraci\u00f3n en NetIQ Access Manager (NAM) , versiones 4.3 y 4.4."}], "id": "CVE-2018-7678", "lastModified": "2026-06-17T02:03:31.423", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security@opentext.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-03-14T15:29:00.257", "references": [{"source": "security@opentext.com", "url": "http://www.securityfocus.com/bid/103421"}, {"source": "security@opentext.com", "url": "https://www.netiq.com/support/kb/doc.php?id=7022724"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/103421"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.netiq.com/support/kb/doc.php?id=7022724"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}