support.broadcom.com
Open in
urlscan Pro
141.202.0.1
Public Scan
Submitted URL: https://support.broadcom.com/external/content/SecurityAdvisories/0/21136
Effective URL: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21136
Submission: On December 20 via api from US — Scanned from DE
Effective URL: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21136
Submission: On December 20 via api from US — Scanned from DE
Form analysis
1 forms found in the DOMName: hrefFm — POST #
<form action="#" aria-hidden="true" class="hide" id="hrefFm" method="post" name="hrefFm"><span></span><input hidden="" type="submit"></form>
Text Content
Menu * Products * Solutions * Support and Services * Company * How To Buy * Log in Log In Register Register Login Multiple Vulnerabilities in Symantec Identity Manager 14.4 Product/Component CA Identity Governance 3 more products List of Products 4 Products * CA Identity Governance * CA Identity Manager * CA Identity Portal * CA Identity Suite Notification Id 21136 Last Updated 16 December 2022 Initial Publication Date 16 December 2022 Status CLOSED Severity HIGH CVSS Base Score 8.6 Summary Symantec has released an update to address below issues that were discovered in Symantec Identity Manager 14.4: * Authentication Bypass of Management Console in Symantec Identity Manager 14.4 * Remote Command Execution (RCE) on Management Console in Symantec Identity Manager 14.4 * XML eXternal Entity injection (XXE) on Management Console in Symantec Identity Manager 14.4 Affected Product(s) Identity Governance And Administration-Identity Manager CVE Supported Version(s) Remediation CVE-2022-25626 CVE-2022-25627 CVE-2022-25628 14.3 14.4 * Customers who are on 14.3 CP3 or 14.4 CP1 can apply the hotfix (link in the 'References' section) * 14.4 CP2 already contains the remediation for this vulnerability Issue Details CVE-2022-25626 Severity / CVSS v3.0: High/8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) References: NVD: CVE-2022-25626 Impact: Authentication Bypass Description: An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session. CVE-2022-25627 Severity / CVSS v3.0: High/7.2 (AV:H/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L) References: NVD: CVE-2022-25627 Impact: Remote Command Execution (RCE) Description: An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4 CVE-2022-25628 Severity / CVSS v3.0: Low/3.1(AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N) References: NVD: CVE-2022-25628 Impact: XML eXternal Entity injection (XXE) Description: An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 Acknowledgements * CVE-2022-25626: Hugo Boutinon & Undr of AXA Group Security * CVE-2022-25627: Hugo Boutinon & Undr of AXA Group Security * CVE-2022-25628: Hugo Boutinon & Undr of AXA Group Security References IGA 14.4: * Non-vApp: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-manager/14-4/Release-Notes/Hotfixes.html * vApp: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-suite/14-4/release-notes/Virtual-Appliance-Release-Notes/Hotfixes.html IGA 14.3: * Non-vApp: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-manager/14-3/Release-Notes/Hotfixes.html * vApp: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-suite/14-3/release-notes/Virtual-Appliance-Release-Notes/Hotfixes.html Revisions 2022-12-16 Initial public release × It appears your Broadcom Products and Services are supported by one of our certified Support partners Click below to be redirected to the appropriate Support Partner Portal to request support For non-product related issues (Support Portal / Licensing) Click HERE Continue × It appears your Broadcom Products and Services are supported by multiple vendors 1. Click below to be redirected to the My Entitlements Portal 2. Expand the appropriate site 3. Expand the product you require support on 4. Click the bug icon under the case column 5. You will be redirected to the appropriate vendor portal to request support For non-product related issues (Support Portal / Licensing) Click HERE Continue × ACCESS DENIED This feature has been disabled by your administrator. × To prevent this message from showing again, please enable pop-up blockers for support.broadcom.com or click Continue to proceed. Continue " + "" + "" + "" + badgecount + "" + " "); /*$('[data-toggle=\"tooltip\"]').tooltip();*/ doc.close(); /* for test */ var doc1 = document.getElementById('chatunread-frame').contentWindow.document; doc1.open(); doc1.write("" + "x " + //"" + ""); doc1.close(); IMIGeneral.storeLocal("style_" + document.getElementById("divicw").getAttribute("data-bind") + "_" + window.location.hostname, msg); document.getElementById('chatbutton').style.display = "block"; } else { document.getElementById("divicw").innerHTML = ''; } } catch (e1) { } }, chatswitchicon: function (type) { console.log("Chatswitchicon::" + type); try { if (type === undefined || type == 1 || type == 0) { var destination = document.getElementById('iframechatwindow').contentWindow; msg = { "action": "register_rtm", "host": window.location.hostname }; destination.postMessage(msg, domainUrl); } /*type=1-max and 0- min */ var isMobile = "0"; // if (window.innerWidth > 768) { // document.getElementById('divchatmain').className = 'main-chat-cont'; // } else { // document.getElementById('divchatmain').className = 'main-chat-cont chatmobile'; // isMobile="1"; // } if ((navigator.userAgent.indexOf("Mobile")) != -1) { isMobile = "1"; } sessionStorage.setItem("data-bind", document.getElementById("divicw").getAttribute("data-bind")); sessionStorage.setItem("data-org", document.getElementById("divicw").getAttribute("data-org")); var iframe = document.getElementById('imi-chatbutton'); if (iframe == null || iframe == undefined) return; var innerDoc = iframe.contentDocument || iframe.contentWindow.document; //Open Widget if (document.getElementById("divchatmain").style.display === 'none' && (type == 1 || type == 2 || type == undefined)) { document.getElementById("divchatmain").style.display = "block"; IMIGeneral.checkmobile(); //if ((window.outerWidth < 497) && (document.documentElement.classList.contains('imichatmobile-active') == false) && document.getElementById("divchatmain").style.display == "block") { var className = " " + document.documentElement.className + " "; if ((window.outerWidth < 700) && (" " + className + " ").replace(/[\n\t]/g, " ").indexOf("imichatmobile-active") > -1 && document.getElementById("divchatmain").style.display == "block") { // if((document.documentElement.classList.value.split(/\s+|\./).filter(word => word === 'imichatmobile-active').length==1) == false){ document.documentElement.classList.remove("imichatmobile-active"); document.documentElement.className = document.documentElement.className + " imichatmobile-active"; // } } else { document.documentElement.className = document.documentElement.className.replace(' imichatmobile-active', ''); } document.getElementById('chatunread-frame').style.display = "none"; innerDoc.getElementById("widgetlbtn").setAttribute("class", "open-btn state1 " + buttonType + " close-btn"); // innerDoc.getElementById("widgetlbtn").setAttribute("aria-label", "Close web chat"); innerDoc.getElementById("widgetlbtn").setAttribute("aria-expanded", "true"); document.getElementById('imi-chatbutton').contentWindow.document.getElementById("chattotalbadge").style.display = "none"; document.getElementById('imi-chatbutton').contentWindow.document.getElementById("chattotalbadge").innerText = ""; localStorage.setItem(fingerprint + "_" + _skey + "_badgecount", 0); localStorage.setItem(fingerprint + "_" + _skey + "_cardcount", 0); IMIChatInit.clearmsgcards(); // if (IMIGeneral.getBrowserName() == "safari") { // if (IMIGeneral.detectIOS()) { // document.body.classList.add('chatnoscroll'); // } // } if (type === undefined) { var destination = document.getElementById('iframechatwindow').contentWindow; msg = { "action": "showiframe", "host": window.location.hostname, "chatmobile": isMobile }; destination.postMessage(msg, domainUrl); document.getElementById("iframechatwindow").setAttribute("aria-hidden","false"); } return; } //Close Widget if (document.getElementById("divchatmain").style.display === 'block' && (type == 0 || type == 2 || type == undefined)) { document.documentElement.className = document.documentElement.className.replace(' imichatmobile-active', ''); //document.body.classList.remove('chatnoscroll'); document.getElementById("divchatmain").style.display = "none"; innerDoc.getElementById("widgetlbtn").setAttribute("class", "open-btn state " + buttonType); innerDoc.getElementById("widgetlbtn").setAttribute("aria-expanded", "false"); innerDoc.getElementById("widgetlbtn").focus(); document.getElementById('chatunread-frame').style.display = "block"; localStorage.setItem(fingerprint + "_" + _skey + "_cardcount", 0); document.getElementById("iframechatwindow").setAttribute("aria-hidden", "true"); return; } //var iframeEl = document.getElementById("iframechatwindow"); // Make sure you are sending a string, and to stringify JSON // iframeEl.contentWindow.postMessage("hello", '*'); return; } catch (e) { console.log("LaunchProactiveMsgManager:" + e.msg); } }, clearmsgcards: function () { document.getElementById('chatunread-frame').contentWindow.document.getElementById("msg-list").innerHTML = ""; document.getElementById('chatunread-frame').contentWindow.document.getElementById("ancclearcards").style.display = "none"; //document.getElementById('imi-chatbutton').contentWindow.document.getElementById("chattotalbadge").style.display = "none"; //document.getElementById('imi-chatbutton').contentWindow.document.getElementById("chattotalbadge").innerText == ""; localStorage.setItem(fingerprint + "_" + _skey + "_cardcount", 0); }, openchat: function (event) { document.getElementById('imichat-fullscreen-modal').className = 'imichat-fullscreen-modal'; var destination = document.getElementById('iframechatwindow').contentWindow; destination.postMessage({ action: 'openchat', threadid: event.data.threadid, proactive_id: event.data.proactive_id }, '*'); parent.IMIChatInit.chatswitchicon(2); }, badgecount: function (event) { try { if (document.getElementById("divchatmain").style.display === 'none') { var count = document.getElementById('imi-chatbutton').contentWindow.document.getElementById("chattotalbadge").innerText; if (count == 0 || count == "") { count = 1; } else { count = parseInt(count) + 1; } var duplicate = 0; var innerDivs; var innerDivsCount = 0; var refChild; IMIChatInit.clearmsgcards(); var containerDiv = document.getElementById('chatunread-frame').contentWindow.document.getElementById("msg-list"); if (count > 1) { innerDivs = containerDiv.getElementsByClassName("msg"); if (innerDivs != undefined) { innerDivsCount = innerDivs.length; for (var i = 0; i < innerDivs.length; i++) { if ("msg_" + event.data.msgtransid == innerDivs[i].id) { duplicate = 1; } } refChild = innerDivs[0]; } } var cardcount; var checkbadgecount; if (innerDivs == undefined) { localStorage.setItem(event.data.fingerprint + "_" + _skey + "_cardcount", 1); } document.getElementById('imi-chatbutton').contentWindow.document.getElementById("chattotalbadge").style.display = "block"; if (duplicate == 0) { if (parseInt(innerDivsCount) == 5) { containerDiv.removeChild(document.getElementById('chatunread-frame').contentWindow.document.getElementsByClassName('msg')[4]); containerDiv.removeChild(document.getElementById('chatunread-frame').contentWindow.document.getElementsByClassName('msgclear')[4]); innerDivsCount = innerDivsCount - 1; } if ((parseInt(innerDivsCount) < 1 && event.data.badge_type === undefined) || event.data.badge_type === 2 || event.data.badge_type === 3) { var node = document.createElement("div"); var node1 = document.createElement("div"); var textnode = document.createTextNode(event.data.msg); if (textnode.data.length > 45) { if (event.data.badge_type === undefined || event.data.badge_type === 2) { textnode.data = textnode.data.substr(0, 45) + "..."; } else { textnode.data = textnode.data; } } node.className = "msg"; node.style = "cursor:pointer;"; node1.className = "msgclear"; node.id = "msg_" + event.data.msgtransid; // Create a text node node1.id = "msgclear_" + event.data.msgtransid; node1.style = "clear:both;"; node.addEventListener("click", function () { window.parent.postMessage({ action: 'openchat', threadid: event.data.threadid, proactive_id: event.data.proactive_id }, '*'); }); if (event.data.msg_from !== undefined && event.data.msg_from !== "") { var span = document.createElement("span"); //var span span.innerHTML = '' + event.data.msg_from + ':'; node.appendChild(span); } else if (event.data.msg_from === undefined || event.data.msg_from == "") { var span = document.createElement("span"); //var span span.innerHTML = 'New Conversation:'; node.appendChild(span); } node.appendChild(textnode); var height = document.getElementsByClassName('main-unreadchat-cont')[0].style.height; if (height == "") { height = 70; } if (innerDivsCount == 0) { height = document.getElementsByClassName('main-unreadchat-cont')[0].style.height = "150px"; } /* else if (innerDivsCount == 2) { height = document.getElementsByClassName('main-unreadchat-cont')[0].style.height = "150px"; } else if (innerDivsCount > 2) {*/ else { document.getElementsByClassName('main-unreadchat-cont')[0].style.height = parseInt(height) + 60 + "px"; } var referenceNode = document.getElementById('chatunread-frame').contentWindow.document.getElementById("msg-list"); // document.querySelector('#some-element'); if (innerDivsCount == 0) { referenceNode.appendChild(node); referenceNode.appendChild(node1); } else { referenceNode.insertBefore(node, refChild); referenceNode.insertBefore(node1, refChild); if ((window.innerHeight + 100) < (document.getElementsByClassName("main-unreadchat-cont")[0].style.height)) { var frame = document.getElementById('chatunread-frame'); var c = frame.contentDocument || frame.contentWindow.document; c.getElementsByTagName("body")[0].offsetHeight = '80%'; c.getElementsByTagName("body")[0].style.overflow = "auto"; } } if (event.data.badge_type === 3) { document.getElementsByClassName("main-unreadchat-cont")[0].style.height = "100%"; var frame = document.getElementById('chatunread-frame'); var c = frame.contentDocument || frame.contentWindow.document; c.getElementsByClassName("msg")[0].style.maxHeight = "unset"; var frameheight = c.getElementsByTagName("body")[0].offsetHeight; document.getElementsByClassName("main-unreadchat-cont")[0].style.height = frameheight + "px"; } } else if (event.data.badge_type === 4) { var fullscreen_modal = document.getElementById('imichat-fullscreen-modal'); fullscreen_modal.className = 'imichat-fullscreen-modal imichat-open'; fullscreen_modal.contentWindow.postMessage({ action: 'bind_data', proactive_id: event.data.proactive_id, threadid: event.data.threadid, msg_from: event.data.msg_from, msg: event.data.msg, btn_chat_now_open: IMILocalisation.getValue(_IMIchat_widget_lang, "proactive_poupup_chat_now_button", "Chat Now"), btn_chat_now_close: IMILocalisation.getValue(_IMIchat_widget_lang, "proactive_poupup_close_button", "Close") }, "*"); } cardcount = parseInt(localStorage.getItem(event.data.fingerprint + "_" + _skey + "_cardcount")) + 1; localStorage.setItem(event.data.fingerprint + "_" + _skey + "_cardcount", cardcount); localStorage.setItem("fingerprint", event.data.fingerprint); localStorage.setItem(event.data.fingerprint + "_" + _skey + "_badgecount", count); document.getElementById('imi-chatbutton').contentWindow.document.getElementById("chattotalbadge").innerText = count; } document.getElementById('chatunread-frame').contentWindow.document.getElementById("ancclearcards").style.display = (event.data.badge_type === undefined || (event.data.badge_type === 2 || event.data.badge_type === 3)) ? "block" : "none"; } } catch (e) { console.log("badgecount:" + e.msg); } }, resize: function () { try { var destination = document.getElementById('iframechatwindow').contentWindow; destination.postMessage({ action: 'resize', width: window.outerWidth //window.innerWidth//screen.width // document.body.clientWidth }, "*"); IMIGeneral.checkmobile(); } catch (e) { } }, LaunchProactiveMsgManager: function (domainName, callback) { try { var widget_styles = localStorage.getItem("style_" + document.getElementById("divicw").getAttribute("data-bind") + "_" + window.location.hostname); if (widget_styles == null && !JSON.parse(widget_styles).enable_proactive) { callback(); return; } var body = document.getElementsByTagName('body')[0]; var script = document.createElement('script'); script.type = 'text/javascript'; script.src = IMIChatInit.domainName() + '/js/proactive-msg-manager.js'; body.appendChild(script); script.addEventListener('load', function (event) { console.log('proactive manager loaded;'); var destination = document.getElementById('iframechatwindow').contentWindow; destination.postMessage({ action: 'proactive-manager-loaded', attrkey: document.getElementById("divicw").getAttribute("data-bind"), host: window.location.hostname }, "*"); callback(); }); } catch (e) { console.log("LaunchProactiveMsgManager:" + e.msg); } }, processAbandonedChats: function (type) { var browser_fingerprint = localStorage.getItem("fingerprint"); var url = IMIGeneral.profileUrl() + "livechats/" + _attr_key + "/customers/" + browser_fingerprint + "/abandoned?host=" + window.document.URL; url = url + "&type=" + type; var body = JSON.stringify({ "is_reloaded": false, "is_closechat": true }); var headers = { type: 'application/json' }; var blob = new Blob([body], headers); navigator.sendBeacon(url); }, handleAbandonedChats: function () { // Attach the event keypress to exclude the F5 refresh //jQuery(window).on('keydown', function (e) { window.addEventListener('keydown', function (e) { if (e.keyCode == 116) { _IMIchat_IsValidNavigation = true; } }); window.addEventListener("beforeunload", function (e) { sessionStorage.setItem(_attr_key + "_imichat-reload-check", document.referrer); console.log(document.referrer); //sessionStorage.setItem("imi_tabid", Math.random().toString(16).slice(2)); if (_IMIchat_IsValidNavigation !== undefined && !_IMIchat_IsValidNavigation) { IMIChatInit.processAbandonedChats("unload"); } }); if (window.performance.navigation.type == 1) { IMIChatInit.processAbandonedChats("load"); } }, loadJQuery: function (domainName, callback) { if (typeof (jQuery) !== 'undefined') { callback(); return; } var body = document.getElementsByTagName('body')[0]; var script = document.createElement('script'); script.type = 'text/javascript'; script.src = domainName + '/js/jquery-3.1.1.js'; body.appendChild(script); script.addEventListener('load', function (event) { callback(); }); return; }, on: function (func_name, callback) { if (typeof callback != 'function') { console.error('function was expected.'); return; } switch (func_name) { case 'imichat-widget:ready': _IMIchat_callback_dic['imichat-widget:ready'] = callback; break; } }, checklocalStorage: function () { var test = 'test'; try { localStorage.setItem(test, test); localStorage.removeItem(test); return true; } catch (e) { return false; } }, call_previous_chats: function () { try { var destination = document.getElementById('iframechatwindow').contentWindow; msg = { "action": "showiframe", "host": window.location.hostname, "chatmobile": ((navigator.userAgent.indexOf("Mobile")) != -1) ? "1" : "0" }; destination.postMessage(msg, domainUrl); } catch (e) { } }, check_clear_session_chats: function () { if (document.referrer == sessionStorage.getItem(_attr_key + "_imichat-reload-check")) { return false; } else if (sessionStorage.getItem(_attr_key + "_imichat-reload-check") == undefined) { return true; } else { console.log("Hey, Thanks for visiting again"); return false; } } }; }(); if (IMIChatInit.checklocalStorage()) { IMIChatInit.init(); } else { document.getElementById("divicw").innerHTML = " \n \n \nError: Cookies Disabled We use cookies to enable best chat experience. Follow these directions to re-enable cookies specific to your browser type or re-open this website in a cookie-enabled browser. "; console.log("Local storage not supported"); } var imichatwidget = { // get hasInitiatedConversation() { // if (sessionStorage.getItem("imichat_hasinitconvexist") == null) // return false; // if (sessionStorage.getItem("imichat_hasinitconvexist") == "1") { // return true; // } else { // return false; // } // }, hasInitiatedChat: function () { if (sessionStorage.getItem("imichat_hasinitconvexist") == null) return false; if (sessionStorage.getItem("imichat_hasinitconvexist") == "1") { return true; } else { return false; } }, show: function () { //$("#divicw").show();return; document.getElementById("divicw").style.display = 'block'; }, hide: function () { // $("#divicw").hide();return; document.getElementById("divicw").style.display = 'none'; }, /* test:function() { if(sessionStorage.getItem("imichat_hasinitconvexist")==null) return false; if(sessionStorage.getItem("imichat_hasinitconvexist")=="1") { return true; } else { return false; } },*/ maximizeWindow: function () { IMIChatInit.chatswitchicon(1); IMIChatInit.resize(); IMIChatInit.call_previous_chats(); return; }, minimizeWindow: function () { return IMIChatInit.chatswitchicon(0); }, init: function (jsondata, callback) { if (typeof callback != 'function') { console.error('function was expected.'); return; } var destination = document.getElementById('iframechatwindow').contentWindow; destination.postMessage({ action: 'imichat_custom_chat_fields', data: jsondata, type: 'add' }, '*'); _IMIchat_callback_dic['imichat-widget:custom_chat_fields_init'] = callback; }, update: function (jsondata, callback) { if (typeof callback != 'function') { console.error('function was expected.'); return; } var destination = document.getElementById('iframechatwindow').contentWindow; destination.postMessage({ action: 'imichat_custom_chat_fields', data: jsondata, type: 'update' }, '*'); _IMIchat_callback_dic['imichat-widget:custom_chat_fields_update'] = callback; }, on: function (func_name, callback) { if (typeof callback != 'function') { console.error('function was expected.'); return; } switch (func_name) { case 'imichat-widget:ready': _IMIchat_callback_dic['imichat-widget:ready'] = callback; break; } } }; /* function imichatWidgetLoaded(){imi imichatwidget.maximizeWindow(); }*/ Top * Products * Solutions * Support and Services * Company * How to Buy Copyright © 2005-2022 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * Privacy * Supplier Responsibility * Terms of Use * Site Map * * * PRIVACY PREFERENCE CENTER * YOUR PRIVACY * STRICTLY NECESSARY COOKIES * PERFORMANCE COOKIES * TARGETING COOKIES YOUR PRIVACY When you visit any web site, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalised web experience. More information STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. BACK BUTTON BACK Vendor Search Filter Button Consent Leg.Interest checkbox label label checkbox label label checkbox label label Clear checkbox label label Apply Cancel Confirm My Choices Allow All By clicking accept, you understand that we use cookies to improve your experience on our website. For more details, please see our Cookie Policy. Cookies Settings Accept Cookies