Novell Identity Manager User Application get request url contains the session token.

Published 8 y ago 2018-03-02 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.3

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.1%

percentile 66%

Public exploits

none known

Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar.

Exploit prediction (EPSS)

1.12% probability of exploitation in the next 30 days, higher than 66% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	4.3	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`
CNA	3.0	4.3	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`

Affected products

NetIQ Identity Manager Applications

Classification

Weakness

CWE-598 Use of HTTP Request With Sensitive Query String
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

download.novell.com /Download?buildid=K7lbPAGJyIk~ · x_refsource_CONFIRM, x_transferred
bugzilla.suse.com /show_bug.cgi?id=1049143 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-9280
NVD: CVE-2017-9280

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.