Back
CVE-2017-9278
Avoid password disclosure via EBS event logging in the iManager Oracle driver
Low3.3EPSS 0.91%
- Published
- Updated
- Reserved
- Assigned by
- microfocus
Description
The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attackers able to read the EBS tables.
Timeline
ID reserved
By microfocus
- 9 months later
· 9 months later
Published
- 7 years later
· 7 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| microfocusCNA (assigner) | 3.0 | Low3.3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Modified | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.91% · top 40% of all CVEs (9 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.
Weakness
- password disclosure via logging
- CWE-532 (opens in a new tab)All about CWE-532 and its CVEs
Affected products
NetIQ · Identity Manager Oracle EBS driver
- affected unspecified – < 4.0.2.0
References (2)
- https://download.novell.com/Download?buildid=DKFkx_xPeaw~ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://bugzilla.suse.com/show_bug.cgi?id=1053200 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2017-9278)Record last updated .