Description
NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://www.novell.com/support/kb/doc.php?id=7016794
Various Sources x_refsource_confirm
https://www.netiq.com/documentation/edirectory-9/edirectory904_releasenotes/data/edirectory904_releasenotes.html
Issue Tracking x_refsource_confirm
https://bugzilla.suse.com/show_bug.cgi?id=1029077
Scores
CVSS v3
5.4
EPSS
0.0021
EPSS Percentile
43.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Details
CWE
CWE-284
CWE-287
Status
published
Products (2)
microfocus/edirectory
< 9.0
netiq/edirectory
9.0 sp1 (3 CPE variants)
Published
Mar 02, 2018
Tracked Since
Feb 18, 2026