CVE-2017-9278: Avoid password disclosure via EBS event logging in the iManager Oracle driver
Published Mar 2, 2018
·Updated
The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the EBS tables.
Affected Software
1 affected component
NetIQ Identity Manager<4.0.2.0
Event History
Mar 2, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-9278?
CVE-2017-9278 is considered a high severity vulnerability due to its potential to expose authentication credentials.
2
How do I fix CVE-2017-9278?
To fix CVE-2017-9278, upgrade to NetIQ Identity Manager version 4.0.2.0 or later.
3
What does CVE-2017-9278 affect?
CVE-2017-9278 affects the NetIQ Identity Manager Oracle EBS driver versions prior to 4.0.2.0.
4
What type of data does CVE-2017-9278 expose?
CVE-2017-9278 potentially exposes the driver authentication password through EBS logs.
5
Who is at risk from CVE-2017-9278?
Attackers with access to read the Oracle EBS tables are at risk of exploiting CVE-2017-9278.