What’s Vulnerable › Vulnerabilities

CVE-2017-7427: iManager - Multiple Reflected Cross-Site Scripting attacks

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-05 · updated 2026-06-17
• Weakness: CWE-79

Description

Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenarios it was possible to execute arbitrary JavaScript code in the context of vulnerable application, via user.Context in the Object Selector, via vdtData in the Version discovery and via nextFrame in the Object Inspector and via Host GUID in the System details plugins.

Affected products

• NetIQ Identity Manager: from 2.7.7.7 before 4.6.1 — fixed in 4.6.1

How to fix

Upgrade to a fixed version: NetIQ Identity Manager 4.6.1. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=1033828
• https://www.novell.com/support/kb/doc.php?id=7021423
• https://bugzilla.suse.com/show_bug.cgi?id=1033828
• https://www.novell.com/support/kb/doc.php?id=7021423

Get alerted when CVE-2017-7427 or the next vulnerability affects your stack