CVE-2017-9280CWE-598

Novell Identity Manager User Application get request url contains the session token.

Medium · published March 2, 2018

CVSS v3.0
4.3
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01116 · 65.8th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2018-03-02T20:00Z
EPSS history
Timeline
  • 02 MAR 20:00Z
    Novell Identity Manager User Application get request url contains the session token.
    cvelistv5