« Volver al listado

CVE-2016-5749

Estado: ModificadaMedia (5.5)—

NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Netiq — Access Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-5749",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "NetIQ Access Manager",
          "versions": [
            {
              "status": "affected",
              "version": "NetIQ Access Manager"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-23T06:59:00.297",
  "references": [
    {
      "url": "https://www.novell.com/support/kb/doc.php?id=7017806",
      "source": "security@opentext.com"
    },
    {
      "url": "https://www.novell.com/support/kb/doc.php?id=7017806",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack."
    },
    {
      "lang": "es",
      "value": "NetIQ Access Manager 4.1 en versiones anteriores a 4.1.2 HF 1 y 4.2 en versiones anteriores a 4.2.2 analizaba solicitudes SAML entrantes con la resolución de entidad externa habilitada, lo que puede conducir a la divulgación de archivos locales a través de un ataque de XXE."
    }
  ],
  "lastModified": "2026-06-17T00:49:58.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netiq:access_manager:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5ADC4C66-A0B0-47E6-8084-C7FBEDC8E503"
            },
            {
              "criteria": "cpe:2.3:a:netiq:access_manager:4.1:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF9068BB-5689-459A-A637-A12F31B36726"
            },
            {
              "criteria": "cpe:2.3:a:netiq:access_manager:4.1:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E5148AA-24E9-4171-8B8F-FA9A1F378EF4"
            },
            {
              "criteria": "cpe:2.3:a:netiq:access_manager:4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20239843-9281-4AEA-A8DE-E0FECFAE7BC5"
            },
            {
              "criteria": "cpe:2.3:a:netiq:access_manager:4.2:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FD82557-1FA6-4335-9A17-C14F27D9B713"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}