CVE-2024-3483
Published: 15 May 2024
Summary
CVE-2024-3483 is a high-severity Command Injection (CWE-77) vulnerability in Microfocus Imanager. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 48.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32069
Vulnerability details
Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Validates or rejects untrusted serialized data before deserialization occurs.
Integrity verification of serialized information can detect tampering before deserialization occurs.