CVE-2024-4555 User impersonation with MFA when configure in specific way
Attackers can impersonate users via improper privilege management in specific MFA configurations, requiring an upgrade to NetIQ Access Manager.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-4555?
CVE-2024-4555 is a high-severity vulnerability in OpenText NetIQ Access Manager, published on 28 Aug 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ Access Manager before 5.0.4.1 and before 5.1
Which versions are affected by CVE-2024-4555?
It affects 1 product.
Products include Microfocus Netiq Access Manager.
How do I fix CVE-2024-4555?
No fix has been published for CVE-2024-4555 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-4555 being exploited?
There is no known exploitation of CVE-2024-4555 in the wild and no public exploit code.
Other vulnerabilities in OpenText NetIQ Access Manager
- CVE-2024-4554 Multiple xss vulnerability in NetIQ Access Manager
- CVE-2024-4556 Directory traversal vulnerability in NetIQ Access Manager
- CVE-2022-26326 Potential open redirection vulnerability in NetIQ Access Manager versions prior to version 5.0.2
- CVE-2022-26325 Cross Site Scripting vulnerability in NetIQ Access Manager versions prior to version 5.0.2
Sources
Also known as GHSA-482j-q2mw-67xq.