Critical Vulnerability in One Identity Manager Enables Escalation

EXECUTIVE SUMMARY:

A critical vulnerability in One Identity Manager, identified as CVE-2024-56404 with a CVSS score of 9.9, affects on-premises installations from versions 9.0.x to 9.2.1. This Insecure Direct Object Reference (IDOR) vulnerability could enable unauthorized privilege escalation, allowing attackers to access sensitive systems and data. One Identity Manager, widely used for managing user identities, access permissions, and security policies, faces significant risk from this flaw. Cloud-based "On Demand" versions are not impacted. Organizations using vulnerable versions of One Identity Manager must promptly apply available hotfixes or upgrade to prevent unauthorized access and data breaches. Swift action is crucial to maintaining secure identity management systems.