Critical severity · published Nov 20, 2020
CVE-2020-25839
NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Identity Manager · Microfocus
4.8; 4.8; 4.8; 4.8; 4.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25839
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25839
www.netiq.com
https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4821_apps/data/releasenotes_idm4821_apps.html
More from Identity Manager
9.8
CVE-2020-11849
Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager
7.5
CVE-2016-1600
The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability