UIM security Vulnerability for CWE-89 found on the OC Server

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

A vulnerability scan found that the machine that has the OC Server on it shows that 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')' vulnerability present.

Environment

UIM 23.4 GA version through CU3/CU6

Resolution

CWE-89 vulnerability will be resolved in UIM 23.4.7 (aka 23.4 CU7).  Currently we are targeting the early March 2026 for this release (subject to change).

Additional Information

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html