Read the docs
TI-2017-03304 Aliases CVE-2017-5189GHSA-3j2p-fcwj-8pcw

private SSL key embedded in JAR file in iManager

Priority LOW 35CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-522 and CWE-287.

Summary

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance.

Why it matters now

EPSS 0.01168 67th percentileScored 2026-11-07
Fix Fixed iManager (NetIQ): 3.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetIQiManagerbefore 3.0.33.0.3Patch availableCNA
  • iManager VendorNetIQ Affected before 3.0.3 Fixed in 3.0.3 Patch available CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:netiq:imanager:2.7:*:*:*:*:*:*:*2.7VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.2:*:*:*:*:*:*:*2.7.2VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.3:*:*:*:*:*:*:*2.7.3VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.4:*:*:*:*:*:*:*2.7.4VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.5:*:*:*:*:*:*:*2.7.5VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.6:*:*:*:*:*:*:*2.7.6VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7:p10:*:*:*:*:*:*2.7.7 p10VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7:p11:*:*:*:*:*:*2.7.7 p11VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7:p4:*:*:*:*:*:*2.7.7 p4VulnerableNetIQ
  • cpe:2.3:a:netiq:imanager:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.5:*:*:*:*:*:*:* Versions 2.7.5 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.6:*:*:*:*:*:*:* Versions 2.7.6 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7:p10:*:*:*:*:*:* Versions 2.7.7 p10 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7:p11:*:*:*:*:*:* Versions 2.7.7 p11 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7:p4:*:*:*:*:*:* Versions 2.7.7 p4 Vulnerable ·NetIQ
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netiq:imanager:2.7.7:p5:*:*:*:*:*:*2.7.7 p5VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7:p6:*:*:*:*:*:*2.7.7 p6VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7:p7:*:*:*:*:*:*2.7.7 p7VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7:p8:*:*:*:*:*:*2.7.7 p8VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7:p9:*:*:*:*:*:*2.7.7 p9VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7.10:hf1:*:*:*:*:*:*2.7.7.10 hf1VulnerableNetIQ
cpe:2.3:a:netiq:imanager:2.7.7.10:hf2:*:*:*:*:*:*2.7.7.10 hf2VulnerableNetIQ
cpe:2.3:a:netiq:imanager:3.0:*:*:*:*:*:*:*3.0VulnerableNetIQ
cpe:2.3:a:netiq:imanager:3.0:sp1:*:*:*:*:*:*3.0 sp1VulnerableNetIQ
cpe:2.3:a:netiq:imanager:3.0:sp2:*:*:*:*:*:*3.0 sp2VulnerableNetIQ
cpe:2.3:a:netiq:imanager:3.0:sp3:*:*:*:*:*:*3.0 sp3VulnerableNetIQ
cpe:2.3:a:netiq:imanager:3.0:sp4:*:*:*:*:*:*3.0 sp4VulnerableNetIQ
cpe:2.3:a:netiq:imanager:3.0.2:p1:*:*:*:*:*:*3.0.2 p1VulnerableNetIQ
cpe:2.3:a:netiq:imanager:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableNetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7:p5:*:*:*:*:*:* Versions 2.7.7 p5 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7:p6:*:*:*:*:*:* Versions 2.7.7 p6 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7:p7:*:*:*:*:*:* Versions 2.7.7 p7 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7:p8:*:*:*:*:*:* Versions 2.7.7 p8 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7:p9:*:*:*:*:*:* Versions 2.7.7 p9 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7.10:hf1:*:*:*:*:*:* Versions 2.7.7.10 hf1 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:2.7.7.10:hf2:*:*:*:*:*:* Versions 2.7.7.10 hf2 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:3.0:sp1:*:*:*:*:*:* Versions 3.0 sp1 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:3.0:sp2:*:*:*:*:*:* Versions 3.0 sp2 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:3.0:sp3:*:*:*:*:*:* Versions 3.0 sp3 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:3.0:sp4:*:*:*:*:*:* Versions 3.0 sp4 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:3.0.2:p1:*:*:*:*:*:* Versions 3.0.2 p1 Vulnerable ·NetIQ
  • cpe:2.3:a:netiq:imanager:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·NetIQ

Remediation

  • Fix · CNA iManager (NetIQ) Fixed in 3.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-5189
  2. 2026-10-03 Alias added: GHSA-3j2p-fcwj-8pcw

References

Other 2

  • TI-2017-05084 Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1… CVSS 3.0CRITICAL 9.8
  • TI-2018-01245 iManager elevation of privilege CVSS 3.0HIGH 8.8
  • TI-2018-01244 NetIQ iManager Communication Downgrade Attack CVSS 3.0HIGH 8.6
  • TI-2017-05083 Cross-site request forgery in Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ… CVSS 3.0HIGH 8.8
  • TI-2017-05077 Multiple Reflected XSS in iManager CVSS 3.0HIGH 7.6
  • TI-2017-03301 Broken or risky cryptographic algorithm in NetIQ/Novell iManager and eDirectory CVSS 3.0HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences