CVE-2024-56404

Published: Jan 24, 2025Modified: Jun 17, 2026Deferred

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: MITRE (Secondary)

Description

In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installations are affected.

Related CWEs

CWE-302

Authentication Bypass by Assumed-Immutable Data

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

References (3)

https://support.oneidentity.com/product-notification/noti-00001678

Source: cve@mitre.org

https://support.oneidentity.com/technical-documents/identity-manager/9.3/release-notes/

Source: cve@mitre.org

https://www.oneidentity.com/community/identity-manager/

Source: cve@mitre.org

Timeline

No history available yet.