Broadcom Symantec Identity Manager vulnerabilities

3 CVEs affecting Broadcom Symantec Identity Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-23951, published 2023-01-26.

More from Broadcom.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-23949, published 2023-01-26. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.
• CVE-2023-23951, published 2023-01-26. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
• CVE-2023-23950, published 2023-01-26. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.