{"id":"CVE-2023-7240","state":"PUBLISHED","title":"Broken Access Control leading to SSRF in NetIQ Identity Console","description":" An improper authorization level has been detected in the login panel. It may lead to\nunauthenticated Server Side Request Forgery and allows to perform open services\nenumeration. Server makes query to provided server (Server IP/DNS field) and is\ntriggering connection to arbitrary address.\n\n","publishedAt":"2024-05-07T13:11:23.031Z","updatedAt":"2024-08-02T08:57:35.206Z","severity":{"score":5.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","source":"OpenText"},"assigner":"OpenText","products":["OpenText NetIQ Identity Console"],"affected":[{"vendor":"OpenText","product":"NetIQ Identity Console","defaultStatus":"unaffected","versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.7.1","versionType":"custom"}],"platforms":["Linux","64 bit"]}],"references":["https://www.netiq.com/documentation/identity-console/identity_console1720000_releasenotes/data/identity_console1720000_releasenotes.html"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/7xxx/CVE-2023-7240.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-7240","state":"PUBLISHED","datePublished":"2024-05-07T13:11:23.031Z","dateUpdated":"2024-08-02T08:57:35.206Z","assignerShortName":"OpenText","assignerOrgId":"f81092c5-7f14-476d-80dc-24857f90be84","dateReserved":"2024-01-23T18:47:50.140Z"},"containers":{"cna":{"title":"Broken Access Control leading to SSRF in NetIQ Identity Console","descriptions":[{"lang":"en","value":" An improper authorization level has been detected in the login panel. It may lead to\nunauthenticated Server Side Request Forgery and allows to perform open services\nenumeration. Server makes query to provided server (Server IP/DNS field) and is\ntriggering connection to arbitrary address.\n\n"}],"affected":[{"vendor":"OpenText","product":"NetIQ Identity Console","defaultStatus":"unaffected","versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.7.1","versionType":"custom"}],"platforms":["Linux","64 bit"]}],"references":[{"url":"https://www.netiq.com/documentation/identity-console/identity_console1720000_releasenotes/data/identity_console1720000_releasenotes.html"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"OpenText","orgId":"f81092c5-7f14-476d-80dc-24857f90be84","dateUpdated":"2024-05-07T13:11:23.031Z"},"datePublic":"2024-03-13T09:45:00.000Z","impacts":[{"capecId":"CAPEC-114","descriptions":[{"lang":"en","value":"CAPEC-114 Authentication Abuse"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"opentext","product":"netiq_identity_console","defaultStatus":"unknown","versions":[{"version":"-","status":"affected","lessThan":"1.7.2","versionType":"custom"}],"cpes":["cpe:2.3:a:opentext:netiq_identity_console:-:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-7240","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-05-07T18:56:02.508836Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:17:29.988Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.netiq.com/documentation/identity-console/identity_console1720000_releasenotes/data/identity_console1720000_releasenotes.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:57:35.206Z"}}]}}}