Symantec Identity Manager - Concerns regarding the existence of polyfill.min.js

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

Is Identity Manager dependent on the polyfill.min.js library?

https://github.com/polyfillpolyfill/polyfill-service/issues/2834

https://www.linkedin.com/posts/bamchenry_cybersecurity-vulnerability-javascript-activity-7167979475882745857--KOz

Location:
/opt/CA/wildfly-idm/modules/system/layers/base/org/jboss/as/console/main/hal-console-3.3.1.Final-resources.jar

Environment

Release : 14.X

Component : IdentitySuite(Identity Suite)

Component : IdentityManager(Identity Manager)

Resolution

Sustaining Engineering reviewed all the blogs about polyfill.min.js, polyfill is used as a lightweight Javascript for UI purposes. After reviewing the Identity Manager infrastructure, the engineering team has confirmed that Identity Manager is not using the polyfill.min.js library. As such, Identity Manager is not exposing any information and is therefore not vulnerable.