Back
CVE-2017-9278
Avoid password disclosure via EBS event logging in the iManager Oracle driver
Low3.3EPSS 0.91%
- Published
- Updated
- Reserved
- Assigned by
- microfocus
Description
The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the EBS tables.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| microfocusCNA (assigner) | 3.0 | Low3.3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Modified | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.91% · top 40% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.
Weakness
- password disclosure via logging
- CWE-532 (opens in a new tab)
Affected products
NetIQ · Identity Manager Oracle EBS driver
- affected unspecified – < 4.0.2.0
References (2)
- https://download.novell.com/Download?buildid=DKFkx_xPeaw~ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://bugzilla.suse.com/show_bug.cgi?id=1053200 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .