CVE-2024-3970

Published: May 15, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure by directory traversal.

Affected (5)

Products: Microfocus: Imanager

Microfocus

1 product

Imanager

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Microfocus Imanager	From 3.0 to 3.2.6
Microfocus Imanager	Version 3.2.6
Microfocus Imanager	Version 3.2.6 patch1
Microfocus Imanager	Version 3.2.6 patch2
Microfocus Imanager	Version 3.2.6 patch3

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html

Source: security@opentext.com

Release Notes

https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

Timeline

No history available yet.