Symantec Identity Governance And Administration
CVE-2022-25627
MEDIUM
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4
AnalysisAI
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-284. An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4 Affected products include: Broadcom Symantec Identity Governance And Administration.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4.
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application. Rat
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. Rated medi
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. Rated m
An unauthenticated user can access Identity Manager’s management console specific page URLs. Rated medium severity (CVSS
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today