9.8

CVE-2017-9285

Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface

NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microfocus ≫ Edirectory Version <= 9.0
Netiq ≫ Edirectory Version 9.0 Update sp1
Netiq ≫ Edirectory Version 9.0 Update sp2
Netiq ≫ Edirectory Version 9.0 Update sp3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.19% 0.65
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
OpenText 5.4 2.8 2.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://www.novell.com/support/kb/doc.php?id=7016794
https://www.netiq.com/documentation/edirectory-9/edirectory904_releasenotes/data/edirectory904_releasenotes.html
https://bugzilla.suse.com/show_bug.cgi?id=1029077