Skip to main content

Symantec Identity Governance And Administration CVE-2022-25626

MEDIUM
Direct Request ('Forced Browsing') (CWE-425)
2022-12-16 secure@symantec.com
Information Disclosure Symantec Identity Governance And Administration
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 16, 2022 - 16:15 nvd
MEDIUM 5.3

DescriptionNVD

An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session.

AnalysisAI

An unauthenticated user can access Identity Manager’s management console specific page URLs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-425. An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session. Affected products include: Broadcom Symantec Identity Governance And Administration.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Symantec Identity Governance And Administration

View all
CVE-2022-25628 HIGH
8.8 Dec 16

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4.
CVE-2022-25627 MEDIUM
6.7 Dec 16

An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Mana
CVE-2023-23951 MEDIUM
6.1 Jan 26

Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application. Rat
CVE-2023-23950 MEDIUM
6.1 Jan 26

User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. Rated medi
CVE-2023-23949 MEDIUM
5.4 Jan 26

An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. Rated m

Same weakness CWE-425 – Direct Request ('Forced Browsing')

View all
CVE-2017-14244 CRITICAL POC
9.8
CVE-2024-0204 CRITICAL POC
9.8
CVE-2017-15235 HIGH POC
7.5
CVE-2024-24592 CRITICAL POC
9.8
CVE-2022-45276 CRITICAL POC
9.8
CVE-2022-26279 CRITICAL POC
9.8
CVE-2021-36560 CRITICAL POC
9.8
CVE-2020-24660 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2022-25626 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy