CVE-2024-11604

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-11604", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "state": "PUBLISHED", "assignerShortName": "OpenText", "dateReserved": "2024-11-21T18:38:16.507Z", "datePublished": "2026-03-27T14:08:59.958Z", "dateUpdated": "2026-03-27T14:49:21.826Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["SCIM Driver"], "platforms": ["Windows", "Linux", "64 bit"], "product": "IDM Driver and Extensions", "vendor": "OpenText", "versions": [{"lessThanOrEqual": "1.0.1.0300", "status": "affected", "version": "1.0.0.0000", "versionType": "rpm, zip"}, {"status": "affected", "version": "1.1.0.0000", "versionType": "rpm, zip"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain sensitive information via access to log files.<p>This issue affects IDM SCIM Driver: 1.0.0.0000 through 1.0.1.0300 and 1.1.0.0000.</p>"}], "value": "Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain sensitive information via access to log files. This issue affects IDM SCIM Driver: 1.0.0.0000 through 1.0.1.0300 and 1.1.0.0000."}], "impacts": [{"capecId": "CAPEC-215", "descriptions": [{"lang": "en", "value": "CAPEC-215 Fuzzing for application mapping"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "USER", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.3, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2026-03-27T14:08:59.958Z"}, "references": [{"tags": ["release-notes"], "url": "https://www.netiq.com/documentation/identity-manager-49-drivers/SCIMDriver1.1.0.0100_readme/data/SCIMDriver1.1.0.0100_readme.html"}, {"tags": ["release-notes"], "url": "https://www.netiq.com/documentation/identity-manager-48-drivers/SCIMDriver1.0.1.0400_readme/data/SCIMDriver1.0.1.0400_readme.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Insertion of Sensitive Information into Log File", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T14:48:05.037247Z", "id": "CVE-2024-11604", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T14:49:21.826Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-11604", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-27T14:48:05.037247Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T14:48:50.355Z"}}], "cna": {"title": "Insertion of Sensitive Information into Log File", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-215", "descriptions": [{"lang": "en", "value": "CAPEC-215 Fuzzing for application mapping"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "USER", "baseScore": 7.3, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:C/RE:M/U:Red", "providerUrgency": "RED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenText", "modules": ["SCIM Driver"], "product": "IDM Driver and Extensions", "versions": [{"status": "affected", "version": "1.0.0.0000", "versionType": "rpm, zip", "lessThanOrEqual": "1.0.1.0300"}, {"status": "affected", "version": "1.1.0.0000", "versionType": "rpm, zip"}], "platforms": ["Windows", "Linux", "64 bit"], "defaultStatus": "affected"}], "references": [{"url": "https://www.netiq.com/documentation/identity-manager-49-drivers/SCIMDriver1.1.0.0100_readme/data/SCIMDriver1.1.0.0100_readme.html", "tags": ["release-notes"]}, {"url": "https://www.netiq.com/documentation/identity-manager-48-drivers/SCIMDriver1.0.1.0400_readme/data/SCIMDriver1.0.1.0400_readme.html", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain sensitive information via access to log files. This issue affects IDM SCIM Driver: 1.0.0.0000 through 1.0.1.0300 and 1.1.0.0000.", "supportingMedia": [{"type": "text/html", "value": "Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain sensitive information via access to log files.<p>This issue affects IDM SCIM Driver: 1.0.0.0000 through 1.0.1.0300 and 1.1.0.0000.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "OpenText", "dateUpdated": "2026-03-27T14:08:59.958Z"}}}, "cveMetadata": {"cveId": "CVE-2024-11604", "state": "PUBLISHED", "dateUpdated": "2026-03-27T14:49:21.826Z", "dateReserved": "2024-11-21T18:38:16.507Z", "assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "datePublished": "2026-03-27T14:08:59.958Z", "assignerShortName": "OpenText"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "modules": ["SCIM Driver"], "platforms": ["Windows", "Linux", "64 bit"], "product": "IDM Driver and Extensions", "vendor": "OpenText", "versions": [{"lessThanOrEqual": "1.0.1.0300", "status": "affected", "version": "1.0.0.0000", "versionType": "rpm, zip"}, {"status": "affected", "version": "1.1.0.0000", "versionType": "rpm, zip"}]}], "source": "security@opentext.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain sensitive information via access to log files. This issue affects IDM SCIM Driver: 1.0.0.0000 through 1.0.1.0300 and 1.1.0.0000."}], "id": "CVE-2024-11604", "lastModified": "2026-06-17T06:58:03.077", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "security@opentext.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-11604", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-27T14:48:05.037247Z", "version": "2.0.3"}}]}, "published": "2026-03-27T15:16:42.807", "references": [{"source": "security@opentext.com", "url": "https://www.netiq.com/documentation/identity-manager-48-drivers/SCIMDriver1.0.1.0400_readme/data/SCIMDriver1.0.1.0400_readme.html"}, {"source": "security@opentext.com", "url": "https://www.netiq.com/documentation/identity-manager-49-drivers/SCIMDriver1.1.0.0100_readme/data/SCIMDriver1.1.0.0100_readme.html"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security@opentext.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows", "linux", "64_bit"], "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0.0000,1.0.1.0300]"}}, {"platform": ["windows", "linux", "64_bit"], "status": "affected", "versions": {"scheme": "generic", "value": "1.1.0.0000"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "IDM Driver and Extensions", "source": "cna", "vendor": "OpenText"}, "product": "idm_driver_and_extensions", "vendor": "opentext"}], "analysis": {"en": {"generated_at": "2026-03-27T16:23:32.306868+00:00", "value": {"mitigation_remediation": ["Upgrade the IDM SCIM Driver to version 1.0.1.0400 or later, or to 1.1.0.0100 or later if you use the 1.1.x line"], "summary": {"action": "Patch", "impact": "Confidentiality loss via log exposure"}, "threat_synthesis": {"affected_systems": "Vulnerable versions of the OpenText IDM Driver and Extensions are 1.0.0.0000 through 1.0.1.0300 and 1.1.0.0000 on Windows and 64\u2011bit Linux platforms.", "description_and_impact": "The flaw is a log injection vulnerability that enables an authenticated local user to view sensitive data recorded by the SCIM Driver module. While processing authentication and user provisioning requests, the driver writes personally identifiable information, authentication tokens, or other protected data directly into log files, creating a straightforward path for confidentiality compromise.", "risk_and_exploitability": "With a CVSS score of 7.3 the vulnerability is considered high severity. EPSS data is not available, and the defect is not listed in the CISA KEV catalog, yet it requires only local authenticated access, which is commonly available to users with log\u2011read or administrative privileges. An attacker who exploits this flaw could retrieve credentials, personal identifiers, or other sensitive information exposed in the logs."}}}}, "created": "2026-03-27T20:28:43.097425+00:00", "updated": "2026-03-30T07:01:54.814951+00:00", "vendors": ["opentext", "opentext$PRODUCT$idm_driver_and_extensions"]}