PT-2017-18891 · Ca · Identity Manager

Published 2017-09-22 · Updated 2017-10-05 · CVE-2017-9393

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CA Identity Manager versions r12.6 to r12.6 SP8 CA Identity Manager versions 14.0 CA Identity Manager version 14.1

Description The issue allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search.

Recommendations For CA Identity Manager versions r12.6 to r12.6 SP8, update to a version that includes a fix for this issue. For CA Identity Manager versions 14.0, update to a version that includes a fix for this issue. For CA Identity Manager version 14.1, update to a version that includes a fix for this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-9393

Affected Products

Identity Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-9393 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9393 · Vendor Advisory
• https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html · Vendor Advisory
• http://securityfocus.com/bid/100956 · Note