CVE-2017-9285: Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface
Published Mar 2, 2018
·Updated
NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services.
Affected Software
4 affected components
Microfocus Edirectory<=9.0
NetIQ eDirectory=9.0-sp1
NetIQ eDirectory=9.0-sp2
NetIQ eDirectory=9.0-sp3
Event History
Mar 2, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-9285?
CVE-2017-9285 is considered a medium severity vulnerability due to the potential for unauthorized access to eDirectory services.
2
How do I fix CVE-2017-9285?
To fix CVE-2017-9285, you should upgrade to NetIQ eDirectory version 9.0 SP4 or later.
3
What does CVE-2017-9285 affect?
CVE-2017-9285 affects NetIQ eDirectory versions prior to 9.0 SP4, including versions 9.0, 9.0 SP1, 9.0 SP2, and 9.0 SP3.
4
What are the consequences of CVE-2017-9285?
The consequences of CVE-2017-9285 include unauthorized access to eDirectory services due to insufficient login restrictions.
5
Is CVE-2017-9285 being actively exploited?
As of the last reports, there is no indication that CVE-2017-9285 is being actively exploited in the wild.