Login restrictions not applied when using ebaclient against NetIQ eDirectory EBA interface
Priority MEDIUM 44CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services.
Why it matters now
EPSS 0.01189 68th percentileScored 2026-11-07
Fix Fixed eDirectory (NetIQ): 9.0 SP4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NetIQ | eDirectory | before 9.0 SP4 | 9.0 SP4 | Patch available | CNA |
- eDirectory VendorNetIQ Affected before 9.0 SP4 Fixed in 9.0 SP4 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:edirectory:*:*:*:*:*:*:*:* | up to 9.0 | Vulnerable | Micro Focus International |
| cpe:2.3:a:netiq:edirectory:9.0:sp1:*:*:*:*:*:* | 9.0 sp1 | Vulnerable | NetIQ |
| cpe:2.3:a:netiq:edirectory:9.0:sp2:*:*:*:*:*:* | 9.0 sp2 | Vulnerable | NetIQ |
| cpe:2.3:a:netiq:edirectory:9.0:sp3:*:*:*:*:*:* | 9.0 sp3 | Vulnerable | NetIQ |
- cpe:2.3:a:microfocus:edirectory:*:*:*:*:*:*:*:* Versions up to 9.0 Vulnerable ·Micro Focus International
- cpe:2.3:a:netiq:edirectory:9.0:sp1:*:*:*:*:*:* Versions 9.0 sp1 Vulnerable ·NetIQ
- cpe:2.3:a:netiq:edirectory:9.0:sp2:*:*:*:*:*:* Versions 9.0 sp2 Vulnerable ·NetIQ
- cpe:2.3:a:netiq:edirectory:9.0:sp3:*:*:*:*:*:* Versions 9.0 sp3 Vulnerable ·NetIQ
Remediation
- Fix · CNA eDirectory (NetIQ) Fixed in 9.0 SP4
Timeline
- 2026-10-02 Threatist record created from CVE-2017-9285
- 2026-10-03 Alias added: GHSA-659h-cg37-9c4x
References
More NetIQ Edirectory vulnerabilities
- TI-2017-05081 Fix for NetIQ shell code upload CVSS 3.0HIGH 8.8
- TI-2018-01246 NetIQ eDirectory Denial of Service CVSS 3.0HIGH 7.5
- TI-2017-03301 Broken or risky cryptographic algorithm in NetIQ/Novell iManager and eDirectory CVSS 3.0HIGH 7.5
- TI-2018-08947 Certificate Revocation Check failure CVSS 3.0HIGH 7.5
Sources
- CVE-2017-9285 · CVE Program
- CVE-2017-9285 · NVD
- FIRST EPSS
- GHSA-659h-cg37-9c4x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences