Broadcom Symantec Identity Governance And Administration vulnerabilities

6 CVEs affecting Broadcom Symantec Identity Governance And Administration, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-23951, published 2023-01-26.

More from Broadcom.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-25627, published 2022-12-16. Medium severity, CVSS 6.7. EPSS: 0.9% chance of exploitation in the next 30 days. An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4
• CVE-2022-25628, published 2022-12-16. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4
• CVE-2022-25626, published 2022-12-16. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session.
• CVE-2023-23949, published 2023-01-26. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.
• CVE-2023-23951, published 2023-01-26. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
• CVE-2023-23950, published 2023-01-26. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.