CVE-2017-7429

April 13, 2021

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server.

Summary:

The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server.

Reference Links(if available):

  • https://www.novell.com/support/kb/doc.php?id=3426981
  • https://www.netiq.com/documentation/edir88/edir88810hf1_releasenotes/data/edir88810hf1_releasenotes.html
  • https://bugzilla.suse.com/show_bug.cgi?id=1024957

  • CVSS Score (if available)

    v2: / HIGHAV:N/AC:L/Au:S/C:P/I:P/A:P

    v3: / HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Links to Exploits(if available)

  • Tags: , , , ,

    You may have missed

    image

    [FOG] – Ransomware Victim: Village Community School (vcsnyc[.]org)

    December 20, 2024
    image

    [MEDUSA] – Ransomware Victim: Broker Educational Sales & Training

    December 20, 2024
    image

    [RANSOMHUB] – Ransomware Victim: tabocas[.]com[.]br

    December 20, 2024
    image

    [FOG] – Ransomware Victim: Circle Electric (circleelectric[.]com)

    December 20, 2024
    image

    [FOG] – Ransomware Victim: Schenkelberg – Die Medienstrategen (schenkelberg-druck[.]de)

    December 20, 2024