CVE-2022-25628 An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4

Description

An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4

Affected products and versions

Product	Affected versions	Fixed in
Symantec Identity Governance and Administration	Versions not published

Other CVEs of Symantec Identity Governance and Administration

The 3 CVEs of Symantec Identity Governance and Administration →

CVE-2022-25626 An unauthenticated user can access Identity Manager’s management console specific page URLs 5.3 Medium CVE-2022-25627 An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on… 6.7 Medium