CVE-2017-9279CWE-434

NetIQ Identity Manager allowed uploading of user icons with incorrect types or extensions

Low · published March 2, 2018

CVSS v3.0
2.0
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Administration, allowing malicious user administrators to potentially execute code or mislead users.

The record
Technical detail
CVSS v3.0
2.0 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00868 · 58.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2018-03-02T20:00Z
EPSS history
Timeline
  • 02 MAR 20:00Z
    NetIQ Identity Manager allowed uploading of user icons with incorrect types or extensions
    cvelistv5