nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access…
Priority LOW 23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Why it matters now
EPSS 0.01922 80th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:access_manager:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:access_manager:4.0.1:*:*:*:*:*:*:* | 4.0.1 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:access_manager:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:access_manager:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Micro Focus International
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-5214
- 2026-10-03 Alias added: GHSA-2rcg-mhmv-j368
References
Exploit 4
- 20141218 SEC Consult SA-20141218-2 :: Multiple high risk vulnerabilities in NetIQ Access Manager
- https://www.novell.com/support/kb/doc.php?id=7015993
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt
- http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html
More Micro Focus International Access Manager vulnerabilities
- TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
- TI-2021-05496 Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1 CVSS 3.1HIGH 8.0
- TI-2026-10249 Reflected Cross-Site Scripting vulnerability in OpenText Access Manager CVSS 4.0HIGH 8.2
- TI-2021-05465 Improper authentication in Access Manager CVSS 3.1HIGH 7.5
- TI-2021-05495 Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1 CVSS 3.1HIGH 7.5
- TI-2014-04266 Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2014-5214 · CVE Program
- CVE-2014-5214 · NVD
- FIRST EPSS
- GHSA-2rcg-mhmv-j368 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences