Symantec Identity Governance And Administration
CVE-2022-25628
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4
AnalysisAI
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 Affected products include: Broadcom Symantec Identity Governance And Administration.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Mana
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application. Rat
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. Rated medi
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. Rated m
An unauthenticated user can access Identity Manager’s management console specific page URLs. Rated medium severity (CVSS
Share
External POC / Exploit Code
Leaving vuln.today