Read the docs
TI-2022-09214 Aliases CVE-2022-25626GHSA-4446-w42r-xvj9

An unauthenticated user can access Identity Manager’s management console specific page…

Priority LOW 31CWE-425Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-425.

Summary

An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00733 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Symantec Identity Governance and Administration14.3, 14.4—No fix listedCNA
  • Symantec Identity Governance and Administration Vendor— Affected 14.3, 14.4 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:symantec_identity_governance_and_administration:14.3:*:*:*:*:*:*:*14.3VulnerableBroadcom
cpe:2.3:a:broadcom:symantec_identity_governance_and_administration:14.4:*:*:*:*:*:*:*14.4VulnerableBroadcom
  • cpe:2.3:a:broadcom:symantec_identity_governance_and_administration:14.3:*:*:*:*:*:*:* Versions 14.3 Vulnerable ·Broadcom
  • cpe:2.3:a:broadcom:symantec_identity_governance_and_administration:14.4:*:*:*:*:*:*:* Versions 14.4 Vulnerable ·Broadcom

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-25626
  2. 2026-10-03 Alias added: GHSA-4446-w42r-xvj9

References

Advisory 1

  • TI-2022-09216 An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 CVSS 3.1HIGH 8.8
  • TI-2023-09746 An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. CVSS 3.1HIGH 8.1
  • TI-2022-09215 Improper access control in Symantec Identity Governance and Administration CVSS 3.1MEDIUM 6.7
  • TI-2023-09748 Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application CVSS 3.1MEDIUM 6.1
  • TI-2023-09747 User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences