Fix for NetIQ shell code upload
Priority MEDIUM 40CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-434 and CWE-295.
Summary
The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated attackers to execute JSP applets on the iManager server.
Why it matters now
EPSS 0.00842 58th percentileScored 2026-11-07
Fix Fixed eDirectory (NetIQ): 8.8.8 Patch 10 HF1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NetIQ | eDirectory | before 8.8.8 Patch 10 HF1 | 8.8.8 Patch 10 HF1 | Patch available | CNA |
- eDirectory VendorNetIQ Affected before 8.8.8 Patch 10 HF1 Fixed in 8.8.8 Patch 10 HF1 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:edirectory:*:*:*:*:*:*:*:* | up to 8.8.8 | Vulnerable | Micro Focus International |
| cpe:2.3:a:netiq:edirectory:8.8.8:patch10:*:*:*:*:*:* | 8.8.8 patch10 | Vulnerable | NetIQ |
| cpe:2.3:a:netiq:edirectory:8.8.8:patch5:*:*:*:*:*:* | 8.8.8 patch5 | Vulnerable | NetIQ |
| cpe:2.3:a:netiq:edirectory:8.8.8:patch6:*:*:*:*:*:* | 8.8.8 patch6 | Vulnerable | NetIQ |
| cpe:2.3:a:netiq:edirectory:8.8.8:patch7:*:*:*:*:*:* | 8.8.8 patch7 | Vulnerable | NetIQ |
| cpe:2.3:a:netiq:edirectory:8.8.8:patch8:*:*:*:*:*:* | 8.8.8 patch8 | Vulnerable | NetIQ |
| cpe:2.3:a:netiq:edirectory:8.8.8:patch9:*:*:*:*:*:* | 8.8.8 patch9 | Vulnerable | NetIQ |
- cpe:2.3:a:microfocus:edirectory:*:*:*:*:*:*:*:* Versions up to 8.8.8 Vulnerable ·Micro Focus International
- cpe:2.3:a:netiq:edirectory:8.8.8:patch10:*:*:*:*:*:* Versions 8.8.8 patch10 Vulnerable ·NetIQ
- cpe:2.3:a:netiq:edirectory:8.8.8:patch5:*:*:*:*:*:* Versions 8.8.8 patch5 Vulnerable ·NetIQ
- cpe:2.3:a:netiq:edirectory:8.8.8:patch6:*:*:*:*:*:* Versions 8.8.8 patch6 Vulnerable ·NetIQ
- cpe:2.3:a:netiq:edirectory:8.8.8:patch7:*:*:*:*:*:* Versions 8.8.8 patch7 Vulnerable ·NetIQ
- cpe:2.3:a:netiq:edirectory:8.8.8:patch8:*:*:*:*:*:* Versions 8.8.8 patch8 Vulnerable ·NetIQ
- cpe:2.3:a:netiq:edirectory:8.8.8:patch9:*:*:*:*:*:* Versions 8.8.8 patch9 Vulnerable ·NetIQ
Remediation
- Fix · CNA eDirectory (NetIQ) Fixed in 8.8.8 Patch 10 HF1
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7429
- 2026-10-03 Alias added: GHSA-9qwr-3g3j-q9gj
References
More NetIQ Edirectory vulnerabilities
- TI-2017-06726 Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface CVSS 3.0CRITICAL 9.8
- TI-2018-01246 NetIQ eDirectory Denial of Service CVSS 3.0HIGH 7.5
- TI-2017-03301 Broken or risky cryptographic algorithm in NetIQ/Novell iManager and eDirectory CVSS 3.0HIGH 7.5
- TI-2018-08947 Certificate Revocation Check failure CVSS 3.0HIGH 7.5
Sources
- CVE-2017-7429 · CVE Program
- CVE-2017-7429 · NVD
- FIRST EPSS
- GHSA-9qwr-3g3j-q9gj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences