SQL injection in NetIQ Identity Manager
Priority MEDIUM 44CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1.
Why it matters now
EPSS 0.01191 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | NetIQ Identity Manager | All versions in the 4.8 line prior to version 4.8 Service Pack 2 HotFix 1 | — | No fix listed | CNA |
- NetIQ Identity Manager Vendor— Affected All versions in the 4.8 line prior to version 4.8 Service Pack 2 HotFix 1 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microfocus:identity_manager:4.8:-:*:*:*:*:*:* | 4.8 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:identity_manager:4.8:hf1:*:*:*:*:*:* | 4.8 hf1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:identity_manager:4.8:sp1:*:*:*:*:*:* | 4.8 sp1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:identity_manager:4.8:sp1_hf1:*:*:*:*:*:* | 4.8 sp1_hf1 | Vulnerable | Micro Focus International |
| cpe:2.3:a:microfocus:identity_manager:4.8:sp2:*:*:*:*:*:* | 4.8 sp2 | Vulnerable | Micro Focus International |
- cpe:2.3:a:microfocus:identity_manager:4.8:-:*:*:*:*:*:* Versions 4.8 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:identity_manager:4.8:hf1:*:*:*:*:*:* Versions 4.8 hf1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:identity_manager:4.8:sp1:*:*:*:*:*:* Versions 4.8 sp1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:identity_manager:4.8:sp1_hf1:*:*:*:*:*:* Versions 4.8 sp1_hf1 Vulnerable ·Micro Focus International
- cpe:2.3:a:microfocus:identity_manager:4.8:sp2:*:*:*:*:*:* Versions 4.8 sp2 Vulnerable ·Micro Focus International
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25839
- 2026-10-03 Alias added: GHSA-53v6-77g8-mpch
References
More Micro Focus International Identity Manager vulnerabilities
- TI-2020-09519 Elevation of privilege and unauthorized access in Micro Focus Identity Manager product CVSS 3.1CRITICAL 9.8
- TI-2016-01456 Information disclosure in NetIQ Identity Manager CVSS 3.0HIGH 7.5
Sources
- CVE-2020-25839 · CVE Program
- CVE-2020-25839 · NVD
- FIRST EPSS
- GHSA-53v6-77g8-mpch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences