Symantec Identity Governance And Administration
CVE-2023-23950
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.
AnalysisAI
User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. Affected products include: Broadcom Symantec Identity Governance And Administration, Broadcom Symantec Identity Manager.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4.
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Mana
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application. Rat
An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. Rated m
An unauthenticated user can access Identity Manager’s management console specific page URLs. Rated medium severity (CVSS
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today