CVE-2017-9280: Novell Identity Manager User Application get request url contains the session token.
Published Mar 2, 2018
·Updated
Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar.
Affected Software
1 affected component
NetIQ Identity Manager<4.5.6.1
Event History
Mar 2, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-9280?
CVE-2017-9280 is classified as a medium severity vulnerability.
2
How do I fix CVE-2017-9280?
To fix CVE-2017-9280, upgrade to NetIQ Identity Manager version 4.5.6.1 or higher.
3
What applications are affected by CVE-2017-9280?
CVE-2017-9280 affects NetIQ Identity Manager applications prior to version 4.5.6.1.
4
What type of exposure does CVE-2017-9280 create?
CVE-2017-9280 can potentially expose user session tokens to untrusted third parties through GET URLs.
5
Is CVE-2017-9280 a session management issue?
Yes, CVE-2017-9280 is related to inadequate session management that includes sensitive session tokens in GET requests.