CA Identity Manager Vulnerability CVE-2022-29701

Products

• CA Identity Manager

Issue/Introduction

Penetration testing may identify a vulnerability related to email flooding (CVE-2022-29701). This issue manifests in the One-Time Password (OTP) validation screen when the OTP attempt limit is set to a specific value. By utilizing a proxy device to intercept and manipulate the request, an attacker can trigger the OTP mechanism more times than the configured limit.

Environment

• Identity Manager
• 14.5

Cause

A flaw in the OTP validation logic allows the request to be re-processed or triggered beyond the specified attempt threshold when intercepted via a proxy. This defect is tracked under:

• Reference Defect: DE592031

Resolution

Broadcom has released a hotfix to address this vulnerability.

1. Download the hotfix DE592031_HF for CA Identity Manager version 14.5.
2. Apply the hotfix to your environment following standard patching procedures.
3. Verify that the OTP attempt limit is functioning as expected after applying the fix.

Note: This fix is included in the release 14.5.1 and later versions.

Additional Information

Reference Defect: DE592031