CVE-2016-5752
HighSummary
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious 'Assertion Consumer Service URL' instead of the original requester.
Risk Assessment
The organization may be exposed to attacks where malicious entities can access sensitive data through improper redirection of SAML results.
Recommendation
It is recommended to upgrade to version 4.1.2 HF1 or 4.2.2 to mitigate this vulnerability.
Other vulnerabilities in NetIQ Access Manager
See all- CVE-2016-5758High
A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load.
- CVE-2016-5754High
The presence of a .htaccess file in NetIQ Access Manager 4.1 before version 4.1.2 Hot Fix 1 and 4.2 before SP2 may lead to information leakage.
Original NVD description (English source)
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester.