CVE-2022-25626

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
n/a	Symantec Identity Governance and Administration	14.3, 14.4

References

https://support.broadcom.com/external/content/SecurityAdvisories/0/21136Release Notes, Vendor Advisory
https://support.broadcom.com/external/content/SecurityAdvisories/0/21136Release Notes, Vendor Advisory

Timeline

Published: Dec 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-256276.7An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Sy CVE-2022-256288.8An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 CVE-2022-256295.4An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be execute CVE-2022-25634.8The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to CVE-2022-256305.4An authenticated user can embed malicious content with XSS into the admin group policy page.CVE-2022-256317.8Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a t CVE-2022-256347.5Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.CVE-2022-256356.5Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet len CVE-2022-256367.8net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds w CVE-2022-256386.5In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. Thi CVE-2022-25649.8Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.CVE-2022-256407.5In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the cert