CVE-2017-7419CWE-79

NetIQ Access Manager OAuth Consent screen XSS attack

Medium · published March 2, 2018

CVSS v3.0
4.6
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider.

The record
Technical detail
CVSS v3.0
4.6 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00749 · 54.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2018-03-02T20:00Z
EPSS history
Timeline
  • 02 MAR 20:00Z
    NetIQ Access Manager OAuth Consent screen XSS attack
    cvelistv5