Описание
NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:netiq:access_manager:4.1:*:*:*:*:*:*:*
cpe:2.3:a:netiq:access_manager:4.1:sp1:*:*:*:*:*:*
cpe:2.3:a:netiq:access_manager:4.1:sp2:*:*:*:*:*:*
cpe:2.3:a:netiq:access_manager:4.2:*:*:*:*:*:*:*
cpe:2.3:a:netiq:access_manager:4.2:sp1:*:*:*:*:*:*
EPSS
Процентиль: 22%
0.00073
Низкий
5.5 Medium
CVSS3
2.1 Low
CVSS2
Дефекты
CWE-611
Связанные уязвимости
CVSS3: 5.5
github
больше 3 лет назад
NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.
EPSS
Процентиль: 22%
0.00073
Низкий
5.5 Medium
CVSS3
2.1 Low
CVSS2
Дефекты
CWE-611