PT-2024-17446 · Opentext · Opentext Privileged Access Manager

Published 2024-12-19 · Updated 2025-10-09 · CVE-2024-12111

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenText Privileged Access Manager versions 23.3(4.4) through 24.3(4.5)

Description In a specific scenario, a LDAP user can abuse the authentication process in OpenText Privileged Access Manager, allowing authentication bypass.

Recommendations For versions 23.3(4.4) and 24.3(4.5), consider temporarily restricting access to the authentication process until a patch is available. As a temporary workaround, consider disabling the LDAP authentication feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-12111

Affected Products

Opentext Privileged Access Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-12111 · Security Note
• https://netiq.com/documentation/privileged-account-manager-44/npam_44_releasenotes/data/npam_44_releasenotes.html · Note
• https://t.me/cvedetector/13372 · Telegram Post
• https://netiq.com/documentation/privileged-access-manager-45/npam_45_releasenotes/data/npam_45_releasenotes.html · Note
• https://twitter.com/VulmonFeeds/status/1869862656754041268 · Twitter Post
• https://t.me/cveNotify/138043 · Telegram Post
• https://twitter.com/CVEnew/status/1869843064396673029 · Twitter Post