Read the docs
TI-2017-06817 Aliases CVE-2017-9393GHSA-h978-qhj9-9fjc

Information disclosure in CA Technologies Identity Manager

Priority MEDIUM 45CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search.

Why it matters now

EPSS 0.01684 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CA TechnologiesIdentity Manager12.6 through 12.6 SP8; 14.0; 14.1—No fix listedCNA
  • Identity Manager VendorCA Technologies Affected 12.6 through 12.6 SP8; 14.0; 14.1 Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:ca:identity_manager:12.6:ga:*:*:*:*:*:*12.6 gaVulnerableCa
cpe:2.3:a:ca:identity_manager:12.6:sp1:*:*:*:*:*:*12.6 sp1VulnerableCa
cpe:2.3:a:ca:identity_manager:12.6:sp2:*:*:*:*:*:*12.6 sp2VulnerableCa
cpe:2.3:a:ca:identity_manager:12.6:sp3:*:*:*:*:*:*12.6 sp3VulnerableCa
cpe:2.3:a:ca:identity_manager:12.6:sp4:*:*:*:*:*:*12.6 sp4VulnerableCa
cpe:2.3:a:ca:identity_manager:12.6:sp5:*:*:*:*:*:*12.6 sp5VulnerableCa
cpe:2.3:a:ca:identity_manager:12.6:sp6:*:*:*:*:*:*12.6 sp6VulnerableCa
cpe:2.3:a:ca:identity_manager:12.6:sp7:*:*:*:*:*:*12.6 sp7VulnerableCa
cpe:2.3:a:ca:identity_manager:12.6:sp8:*:*:*:*:*:*12.6 sp8VulnerableCa
cpe:2.3:a:ca:identity_manager:14.0:*:*:*:*:*:*:*14.0VulnerableCa
  • cpe:2.3:a:ca:identity_manager:12.6:ga:*:*:*:*:*:* Versions 12.6 ga Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:12.6:sp1:*:*:*:*:*:* Versions 12.6 sp1 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:12.6:sp2:*:*:*:*:*:* Versions 12.6 sp2 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:12.6:sp3:*:*:*:*:*:* Versions 12.6 sp3 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:12.6:sp4:*:*:*:*:*:* Versions 12.6 sp4 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:12.6:sp5:*:*:*:*:*:* Versions 12.6 sp5 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:12.6:sp6:*:*:*:*:*:* Versions 12.6 sp6 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:12.6:sp7:*:*:*:*:*:* Versions 12.6 sp7 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:12.6:sp8:*:*:*:*:*:* Versions 12.6 sp8 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Ca
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ca:identity_manager:14.1:*:*:*:*:*:*:*14.1VulnerableCa
cpe:2.3:a:ca:identity_manager_virtual_appliance:14.0:*:*:*:*:*:*:*14.0VulnerableCa
cpe:2.3:a:ca:identity_manager_virtual_appliance:14.1:*:*:*:*:*:*:*14.1VulnerableCa
  • cpe:2.3:a:ca:identity_manager:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager_virtual_appliance:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Ca
  • cpe:2.3:a:ca:identity_manager_virtual_appliance:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Ca

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9393
  2. 2026-10-03 Alias added: GHSA-h978-qhj9-9fjc

References

Advisory 1

  • TI-2015-03903 Improper input validation in CA Privileged Access Manager CVSS 3.0CRITICAL 9.8
  • TI-2018-11179 Deserialization of untrusted data in CA Technologies Release Automation CVSS 3.0CRITICAL 9.8
  • TI-2018-06542 Improper privilege management in CA Privileged Access Manager CVSS 3.1CRITICAL 9.8
  • TI-2018-06541 Improper privilege management in CA Privileged Access Manager CVSS 3.1CRITICAL 9.8
  • TI-2018-06488 Improper input validation in CA Technologies Workload Control Center CVSS 3.0CRITICAL 9.8
  • TI-2019-10262 Improper access control in CA Technologies Client Automation CVSS 3.1CRITICAL 9.8
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences