CVE-2014-5216

NetIQ Access Manager 4.x - Cross-Site Scripting via Multiple Parameters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-5216.

AI-analyzed exploit summary This is a detailed security advisory from SEC Consult Vulnerability Lab describing multiple high-risk vulnerabilities in NetIQ Access Manager 4.0 SP1, including XXE, XSS, CSRF, and information disclosure. It provides technical details, proof-of-concept URLs, and exploitation scenarios.

Description

Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc, (2) the error parameter to nidp/jsp/x509err.jsp, (3) the lang parameter to sslvpn/applet_agent.jsp, or (4) the secureLoggingServersA parameter to roma/system/cntl, a different issue than CVE-2014-9412.

Exploits (1)

exploitdb WRITEUP

webappsjsp

https://www.exploit-db.com/exploits/35594

View Code ZIP pw:eip

This is a detailed security advisory from SEC Consult Vulnerability Lab describing multiple high-risk vulnerabilities in NetIQ Access Manager 4.0 SP1, including XXE, XSS, CSRF, and information disclosure. It provides technical details, proof-of-concept URLs, and exploitation scenarios.

Classification

Writeup 100%

Attack Type

Xss | Info Leak | Auth Bypass | Other

Complexity

Moderate

Reliability

Reliable

Target: NetIQ Access Manager 4.0 SP1

Auth required

Prerequisites: Authenticated administrative access for some exploits · Network access to the target system

MITRE ATT&CK