CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=1021637
https://www.netiq.com/support/kb/doc.php?id=7016795

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:netiq:imanager:2.7:::::::*
	cpe:2.3:a:netiq:imanager:2.7.1:::::::*
	cpe:2.3:a:netiq:imanager:2.7.2:::::::*
	cpe:2.3:a:netiq:imanager:2.7.3:::::::*
	cpe:2.3:a:netiq:imanager:2.7.4:::::::*
	cpe:2.3:a:netiq:imanager:2.7.5:::::::*
	cpe:2.3:a:netiq:imanager:2.7.6:::::::*
	cpe:2.3:a:netiq:imanager:2.7.7:p10::::::
	cpe:2.3:a:netiq:imanager:2.7.7:p11::::::
	cpe:2.3:a:netiq:imanager:2.7.7:p4::::::
	cpe:2.3:a:netiq:imanager:2.7.7:p5::::::
	cpe:2.3:a:netiq:imanager:2.7.7:p6::::::
	cpe:2.3:a:netiq:imanager:2.7.7:p7::::::
	cpe:2.3:a:netiq:imanager:2.7.7:p8::::::
	cpe:2.3:a:netiq:imanager:2.7.7:p9::::::
	cpe:2.3:a:netiq:imanager:2.7.7.10:hf1::::::
	cpe:2.3:a:netiq:imanager:2.7.7.10:hf2::::::
	cpe:2.3:a:netiq:imanager:3.0:::::::*
	cpe:2.3:a:netiq:imanager:3.0:sp1::::::
	cpe:2.3:a:netiq:imanager:3.0:sp2::::::
	cpe:2.3:a:netiq:imanager:3.0:sp3::::::
	cpe:2.3:a:netiq:imanager:3.0:sp4::::::
	cpe:2.3:a:netiq:imanager:3.0.2:p1::::::
	cpe:2.3:a:netiq:imanager:3.0.3:::::::*

History

No history.

Information

Published : 2018-03-02 20:29

Updated : 2023-11-07 02:49

NVD link : CVE-2017-5189

Mitre link : CVE-2017-5189

CVE.ORG link : CVE-2017-5189

JSON object : View

Products Affected

netiq

imanager

CWE

CWE-287

Improper Authentication

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2017-5189", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security@opentext.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2018-03-02T20:29:00.380", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1021637", "source": "security@opentext.com"}, {"url": "https://www.netiq.com/support/kb/doc.php?id=7016795", "source": "security@opentext.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Secondary", "source": "security@opentext.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance."}, {"lang": "es", "value": "NetIQ iManager, en versiones anteriores a la 3.0.3, entregaba una clave privada SSL en una aplicaci\u00f3n Java (archivo JAR) para autenticaci\u00f3n en Sentinel, lo que permite que atacantes remotos extraigan y establezcan sus propias conexiones en la aplicaci\u00f3n de Sentinel."}], "lastModified": "2023-11-07T02:49:21.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netiq:imanager:2.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9044A0FA-BD4E-4041-B16A-0C70551C65F7"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94134CE0-B4A4-477B-99E7-87F34B0F2CED"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DB1AB4D-3906-4EDA-A514-FAE007A27095"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC9CA1AA-A933-4BB6-81F1-B803A2D12FB2"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56B58611-550D-408E-8104-71ACD4A19FAA"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1842E298-D918-433F-9681-DF4AF9849029"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C93EB7FE-4A3A-4273-B5B5-CF6473C4D1F4"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7:p10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46A640AB-5C61-4801-9EB3-DA4FD6C43FE5"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7:p11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B6B6F6C-1CD2-4823-A224-DDFAC5FD7C6A"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52355F37-8540-4868-A565-E2109DA7ABA8"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9B213A2-2BED-4D5F-86AA-E4FE29352E8A"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7:p6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2413E8E-7B96-434D-BF9B-3C769F931157"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7:p7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A70BA4BB-6398-46C5-9E16-4536AAD30011"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7:p8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6644CB8E-DC8E-46F4-8EFF-CEF34EC40116"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7:p9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "088DA16B-2DCA-4EA5-86BC-93796D9F0E73"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7.10:hf1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7447ECD4-EA24-45F9-BF0D-971D074EAB4D"}, {"criteria": "cpe:2.3:a:netiq:imanager:2.7.7.10:hf2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91F3BCB4-6160-48DA-8CFA-88BD1FED1C84"}, {"criteria": "cpe:2.3:a:netiq:imanager:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D3D7F7B-CF13-4729-BDC8-FA7C25EB0856"}, {"criteria": "cpe:2.3:a:netiq:imanager:3.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A8EC935-B012-4F5C-AF33-3438EEA18BD0"}, {"criteria": "cpe:2.3:a:netiq:imanager:3.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3A86186-B039-4F7F-BE13-A5C2987C63B6"}, {"criteria": "cpe:2.3:a:netiq:imanager:3.0:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0C76139-7684-4E41-B8BC-5D9DC6B47ABA"}, {"criteria": "cpe:2.3:a:netiq:imanager:3.0:sp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9AF38F2-611C-4557-8CB8-FEA46F84A779"}, {"criteria": "cpe:2.3:a:netiq:imanager:3.0.2:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F68364C6-7A48-49E7-BC89-6DF5181EEF2D"}, {"criteria": "cpe:2.3:a:netiq:imanager:3.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2482872E-C1FE-4E4E-833A-A426CC4E1230"}], "operator": "OR"}]}], "sourceIdentifier": "security@opentext.com"}