CVE-2024-12799

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse. This vulnerability could allow an authenticated user to obtain higher privileged user’s sensitive information via crafted payload.

This issue affects Identity Manager Advanced Edition: from 4.8.0.0 through 4.8.7.0102, 4.9.0.0.

Metrics

CVSS 4.0 10.0/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:H/U:Red

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Mar 5, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-128004.8The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as adm CVE-2024-128012.4Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, al CVE-2024-128029.1SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Secur CVE-2024-128037.2A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and poten CVE-2024-128057.2A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads t CVE-2024-128064.9A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file.CVE-2024-128074.8The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privileg CVE-2024-128084.8The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not san CVE-2024-128096.4The Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions CVE-2024-128108.1The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of dat CVE-2024-128118.8The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This make CVE-2024-128127.5The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected