CVE-2014-5217: CSRF
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5217?
CVE-2014-5217 has a medium severity rating due to its potential to allow unauthorized administrative actions.
How do I fix CVE-2014-5217?
To fix CVE-2014-5217, update your NetIQ Access Manager to version 4.1 or later.
What types of attacks are possible due to CVE-2014-5217?
CVE-2014-5217 may allow attackers to perform cross-site request forgery attacks, leading to unauthorized password changes by hijacking administrator sessions.
Which versions of NetIQ Access Manager are affected by CVE-2014-5217?
CVE-2014-5217 affects NetIQ Access Manager versions 4.0 and 4.0.1.
Who is primarily at risk due to CVE-2014-5217?
Administrators using vulnerable versions of NetIQ Access Manager are primarily at risk due to potential session hijacking.