Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the…
Priority LOW 33CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword action.
Why it matters now
EPSS 0.01367 72nd percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:access_manager:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:access_manager:4.0.1:*:*:*:*:*:*:* | 4.0.1 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:access_manager:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:access_manager:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Micro Focus International
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2014-5217
- 2026-10-03 Alias added: GHSA-wrg8-w9p8-8mv3
References
Exploit 4
- 20141218 SEC Consult SA-20141218-2 :: Multiple high risk vulnerabilities in NetIQ Access Manager
- https://www.novell.com/support/kb/doc.php?id=7015997
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-2_Novell_NetIQ_Access_Manager_Multiple_Vulnerabilities_v10.txt
- http://packetstormsecurity.com/files/129658/NetIQ-Access-Manager-4.0-SP1-XSS-CSRF-XXE-Injection-Disclosure.html
More Micro Focus International Access Manager vulnerabilities
- TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
- TI-2021-05496 Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1 CVSS 3.1HIGH 8.0
- TI-2026-10249 Reflected Cross-Site Scripting vulnerability in OpenText Access Manager CVSS 4.0HIGH 8.2
- TI-2021-05465 Improper authentication in Access Manager CVSS 3.1HIGH 7.5
- TI-2021-05495 Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1 CVSS 3.1HIGH 7.5
- TI-2026-10248 Missing Authorization Vulnerability in OpenText Access Manager CVSS 4.0MEDIUM 6.3
Sources
- CVE-2014-5217 · CVE Program
- CVE-2014-5217 · NVD
- FIRST EPSS
- GHSA-wrg8-w9p8-8mv3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences