CVE-2024-4555

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ Access Manager before 5.0.4.1 and before 5.1

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-266 CWE-269

Affected software

Vendor	Product	Versions
OpenText	NetIQ Access Manager	>= 5.0.4.1, < <; >= 5.1, < <
netiq	access_manager	< 5.0.4.1; < 5.1

References

https://www.microfocus.com/documentation/access-manager/5.0/accessmanager504-p1-release-notes/accessmanager504-p1-release-notes.htmlRelease Notes, Vendor Advisory
https://www.microfocus.com/documentation/access-manager/5.1/accessmanager51-release-notes/accessmanager51-release-notes.htmlRelease Notes, Vendor Advisory

Timeline

Published: Aug 28, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-455507.8Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.CVE-2024-455516.2Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, pote CVE-2024-455528.2Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC stand CVE-2024-455537.8Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another CVE-2024-455547.0Memory corruption during concurrent SSR execution due to race condition on the global maps list.CVE-2024-455557.8Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs CVE-2024-455566.5Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.CVE-2024-455577.8Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.CVE-2024-455587.5Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length CVE-2024-455595.5Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.CVE-2024-45567.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access CVE-2024-455607.0Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.