by Kastro
Paper/Archive/CVE-2024-12799

CVE-2024-12799

OpenText Identity Manager Advanced Edition — Insufficiently Protected Credentials

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
37
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 32.8.328 × 206.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse. This vulnerability could allow an authenticated user to obtain higher privileged user’s sensitive information via crafted payload. This issue affects Identity Manager Advanced Edition: from 4.8.0.0 through 4.8.7.0102, 4.9.0.0.

Affected

ProductAffectedFixed inSource
Identity Manager Advanced Edition4.8.0.0 – 4.8.7.0102–CNA
Identity Manager Advanced Edition4.9.0.0–CNA

Scores by source

OpenText (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/V:C/RE:H/U:Red
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refportal.microfocus.com/s/article/KM000037455