title: NetIQ Access Manager OAuth Consent screen XSS attack
description: A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider.
problem types: cross site scripting attack
affected:
{
product: Access Manager
vendor: NetIQ
versions:
lessThan: 4.3.2, status: affected, version: 4.3, versionType: custom
lessThan: 4.2.4, status: affected, version: 4.2, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.0
]