title: NetIQ Identity Manager allowed uploading of user icons with incorrect types or extensions
description: NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Administration, allowing malicious user administrators to potentially execute code or mislead users.
problem types: Upload of files possible that could be misused for other purposes
affected:
{
product: Identity Manager
vendor: NetIQ
versions:
lessThan: 4.5.6.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
version: 3.0
]