CVE-2020-25839

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM 4.8 SP2 HF1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	NetIQ Identity Manager	All versions in the 4.8 line prior to version 4.8 Service Pack 2 HotFix 1

References

Timeline

Published: Nov 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-25844.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.28 and CVE-2020-258406.1Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could CVE-2020-258427.5The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files throu CVE-2020-258439.8NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers c CVE-2020-258449.8The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole CVE-2020-258457.4Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malici CVE-2020-258467.4The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redir CVE-2020-258478.8This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed th CVE-2020-258489.8HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.CVE-2020-258498.8MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parame CVE-2020-25855.9Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u231. Diffic CVE-2020-258507.5The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to downl