PT-2020-16237 · Netiq · Netiq Identity Manager

Norbert Klasen · Published 2020-11-20 · Updated 2020-12-09 · CVE-2020-25839

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetIQ Identity Manager versions prior to 4.8 SP2 HF1

Description The issue is an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1.

Recommendations For versions prior to 4.8 SP2 HF1, update to NetIQ IdM 4.8 SP2 HF1 to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-25839

Affected Products

Netiq Identity Manager

References · 6

• https://osv.dev/vulnerability/CVE-2020-25839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25839 · Security Note
• https://t.me/cibsecurity/16667 · Telegram Post
• https://t.me/cibsecurity/17413 · Telegram Post
• https://netiq.com/documentation/identity-manager-48/releasenotes_idm4821_apps/data/releasenotes_idm4821_apps.html · Note
• https://t.me/cvenotify/5940 · Telegram Post