PT-2023-12863 · Netiq · Netiq Identity Manager

Published 2023-01-24 · Updated 2023-02-01 · CVE-2022-26329

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetIQ Identity Manager versions prior to 4.8.5

Description The issue allows an attacker to determine whether a file exists on the filesystem. This is a file existence disclosure vulnerability in the NetIQ Identity Manager plugin.

Recommendations For versions prior to 4.8.5, update to version 4.8.5 or later to resolve the issue.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-538

CWE-668

Related Identifiers

CVE-2022-26329

Affected Products

Netiq Identity Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-26329 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26329 · Vendor Advisory
• https://netiq.com/documentation/identity-manager-48/releasenotes_idm485/data/software-fixes.html · Note