Medium severity · published Dec 16, 2022
CVE-2022-25626
An unauthenticated user can access Identity Manager’s management console specific page URLs
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Symantec Identity Governance And Administration · Broadcom
14.3; 14.4 · source: NVD
Affected product
SI
Symantec Identity Governance And Administration
Broadcom
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25626
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25626
Release Notes
https://support.broadcom.com/external/content/SecurityAdvisories/0/21136
More from Symantec Identity Governance And Administration
8.8
CVE-2022-25628
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4
6.7
CVE-2022-25627
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4
6.1
CVE-2023-23951
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
6.1
CVE-2023-23950
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses
5.4
CVE-2023-23949
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser