Description
CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/100956
Vendor Advisory x_refsource_confirm
https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20170921-01--security-notice-for-ca-identity-manager.html
Scores
CVSS v3
9.8
EPSS
0.0168
EPSS Percentile
74.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-200
Status
published
Products (8)
ca/identity_manager
12.6 ga (9 CPE variants)
ca/identity_manager
14.0
ca/identity_manager
14.1
ca/identity_manager_virtual_appliance
14.0
ca/identity_manager_virtual_appliance
14.1
CA Technologies/Identity Manager
12.6 through 12.6 SP8
CA Technologies/Identity Manager
14.0
CA Technologies/Identity Manager
14.1
Published
Sep 22, 2017
Tracked Since
Feb 18, 2026