Broadcom Privileged Access Manager vulnerabilities

10 CVEs affecting Broadcom Privileged Access Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-7392, published 2019-02-26.

More from Broadcom.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-4664, published 2018-06-18. Critical severity, CVSS 9.8. EPSS: 20.6% chance of exploitation in the next 30 days. An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
• CVE-2018-9022, published 2018-06-18. Critical severity, CVSS 9.8. EPSS: 12.8% chance of exploitation in the next 30 days. An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file.
• CVE-2018-9021, published 2018-06-18. Critical severity, CVSS 9.8. EPSS: 9.6% chance of exploitation in the next 30 days. An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests.
• CVE-2018-9023, published 2018-06-18. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing specially crafted arguments to the update_crld script.
• CVE-2018-9029, published 2018-06-18. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL injection attacks.
• CVE-2019-7392, published 2019-02-26. Critical severity, CVSS 9.1. EPSS: 1.7% chance of exploitation in the next 30 days. An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration.
• CVE-2018-9025, published 2018-06-18. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input.
• CVE-2018-9026, published 2018-06-18. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A session fixation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to hijack user sessions with a specially crafted request.
• CVE-2018-9024, published 2018-06-18. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. An improper authentication vulnerability in CA Privileged Access Manager 2.x allows attackers to spoof IP addresses in a log file.
• CVE-2018-9028, published 2018-06-18. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Weak cryptography used for passwords in CA Privileged Access Manager 2.x reduces the complexity for password cracking.