PT-2025-3275 · One Identity · One Identity Identity Manager

Published 2024-12-20 · Updated 2025-02-05 · CVE-2024-56404

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions One Identity Identity Manager versions prior to 9.3

Description An insecure direct object reference (IDOR) issue allows privilege escalation. Only On-Premise installations are affected. The vulnerability can be exploited by a remote attacker to elevate their privileges, potentially bypassing authentication through supposedly immutable data.

Recommendations One Identity Identity Manager versions prior to 9.3: Update to version 9.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation until the update is applied.

Fix

LPE

Weakness Enumeration

CWE-302

Related Identifiers

BDU:2025-01232

CVE-2024-56404

Affected Products

One Identity Identity Manager

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-56404 · Security Note
• https://bdu.fstec.ru/vul/2025-01232 · Security Note
• https://twitter.com/Brandefense/status/1887033527775957125 · Twitter Post
• https://twitter.com/Dinosn/status/1884088148160094561 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1884207656119734647 · Twitter Post
• https://twitter.com/TMJIntel/status/1884230197395796306 · Twitter Post
• https://twitter.com/CveFindCom/status/1882844198107263304 · Twitter Post
• https://twitter.com/CVEnew/status/1882843158377087283 · Twitter Post
• https://oneidentity.com/community/identity-manager · Note
• https://t.me/pentestingnews/55757 · Telegram Post
• https://support.oneidentity.com/product-notification/noti-00001678 · Note
• https://support.oneidentity.com/technical-documents/identity-manager/9.3/release-notes · Note
• https://twitter.com/the_yellow_fall/status/1884074410296140038 · Twitter Post