OpenText Identity Manager Advanced Edition Insufficiently Protected Credentials Vulnerability Allowing Privilege Abuse

A vulnerability allowing insufficiently protected credentials has been identified in OpenText Identity Manager Advanced Edition versions 4.8.0.0 through 4.8.7.0102 and 4.9.0.0 on Windows and Linux (64-bit). This vulnerability could enable an authenticated user to access sensitive information of higher privileged users through crafted payloads, facilitating privilege abuse.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information of higher privileged users, allowing for potential privilege abuse.

Remediation

To address this vulnerability, users can stop the Tomcat service running Identity Applications, back up the UIRegistry.jar file, and then replace it with a patched version. Instructions for applying the patch vary depending on the specific version of Identity Manager in use.