CVE-2012-5930

The CVE-2012-5930 entry concerns NetIQ Privileged User Manager (PUM) 2.3.x prior to 2.3.1 HF2. The pa_modify_accounts function in auth.dll (unifid.exe) does not require authentication for modifyAccounts, allowing remote attackers to change administrative passwords via a crafted application/x-amf ...

NetIQ Privileged User Manager Password Change Authentication Bypass (version check)

According to the self-reported version of the NetIQ Privileged User Manager 'auth' package, the password for the 'admin' user of the NetIQ Privileged User Manager web application can be modified without authenticating via a specially crafted POST request. Note that Nessus did not check for the...