« Volver al listado

CVE-2020-25839

Estado: ModificadaCrítica (9.8)—

NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microfocus — Identity Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-25839",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "NetIQ Identity Manager",
          "versions": [
            {
              "status": "affected",
              "version": "All versions in the 4.8 line prior to version 4.8 Service Pack 2 HotFix 1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-20T16:15:15.683",
  "references": [
    {
      "url": "https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4821_apps/data/releasenotes_idm4821_apps.html",
      "source": "security@opentext.com"
    },
    {
      "url": "https://www.netiq.com/documentation/identity-manager-48/releasenotes_idm4821_apps/data/releasenotes_idm4821_apps.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1."
    },
    {
      "lang": "es",
      "value": "NetIQ Identity Manager versiones 4.8 anteriores a 4.8 SP2 HF1, está afectado por una vulnerabilidad de inyección. Esta vulnerabilidad es corregida en NetIQ IdM versión 4.8 SP2 HF1"
    }
  ],
  "lastModified": "2026-06-17T03:07:22.467",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:identity_manager:4.8:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E38FF3B-6362-41F6-B146-325DFA469682"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:identity_manager:4.8:hf1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15D47EC4-9539-4E8B-BBF2-5BA0CEBE2067"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:identity_manager:4.8:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04FA4595-19FA-440A-9021-BB3C6710A9BB"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:identity_manager:4.8:sp1_hf1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C137C4AC-7BB1-48D1-93FB-548628FD33DC"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:identity_manager:4.8:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A69B4FD2-D6F8-45CD-A516-F7307B404BC3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}