CVE-2025-13478

Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via insecure application cache handling. This issue affects Identity Manager: 25.2(v4.10.1).

CVSS

No CVSS.

References

Link	Resource
https://docs.microfocus.com/doc/2159/25.2/cvesecurityfix
https://docs.microfocus.com/doc/2159/25.2/releasenotesidentitymanager4101patch01

Configurations

No configuration.

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de mala configuración de caché en OpenText Identity Manager en Windows, Linux permite a usuarios autenticados remotos obtener datos de sesión de otro usuario a través de un manejo inseguro de la caché de la aplicación. Este problema afecta a Identity Manager: 25.2(v4.10.1).

Information

Published : 2026-03-27 14:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-13478

Mitre link : CVE-2025-13478

CVE.ORG link : CVE-2025-13478

JSON object : View

Products Affected

No product.

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2025-13478", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13478", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T13:53:25.686345Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@opentext.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@opentext.com", "affectedData": [{"vendor": "OpenText", "product": "Identity Manager", "versions": [{"status": "affected", "version": "25.2(v4.10.1)"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-03-27T14:16:07.450", "references": [{"url": "https://docs.microfocus.com/doc/2159/25.2/cvesecurityfix", "source": "security@opentext.com"}, {"url": "https://docs.microfocus.com/doc/2159/25.2/releasenotesidentitymanager4101patch01", "source": "security@opentext.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@opentext.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via insecure application cache handling. This issue affects Identity Manager: 25.2(v4.10.1)."}, {"lang": "es", "value": "Vulnerabilidad de mala configuraci\u00f3n de cach\u00e9 en OpenText Identity Manager en Windows, Linux permite a usuarios autenticados remotos obtener datos de sesi\u00f3n de otro usuario a trav\u00e9s de un manejo inseguro de la cach\u00e9 de la aplicaci\u00f3n. Este problema afecta a Identity Manager: 25.2(v4.10.1)."}], "lastModified": "2026-10-07T09:10:00.160", "sourceIdentifier": "security@opentext.com"}