CVE-2017-7589

Name: CVE-2017-7589
Creator: NVD / NIST
Published: 2017-04-09T01:59:00.183+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.02%

Last modified Jun 17, 2026

CVE-2017-7589 is a vulnerability of currently unknown severity. In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by the "anonymous" user, as demonstrated by responses with a 200 HTTP status code and a JSON object containing IP address strings. This is related to a missing access-control check in bin/defaults/script/info/login.js.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.

Description

In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by the "anonymous" user, as demonstrated by responses with a 200 HTTP status code and a JSON object containing IP address strings. This is related to a missing access-control check in bin/defaults/script/info/login.js.

Metrics

EPSS Probability

1.02%

59.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-200

Affected Software

Vendor	Product	Versions
Openidm Project	Openidm	<= 4.0.0
Openidm Project	Openidm	4.5.0

References

http://www.rootlabs.com.br/information-disclosure-forgerock-openidm-4-0-0-and-4-5-0/Exploit, Third Party Advisory
https://backstage.forgerock.com/knowledge/kb/article/a92936505Mitigation, Third Party Advisory
http://www.rootlabs.com.br/information-disclosure-forgerock-openidm-4-0-0-and-4-5-0/Exploit, Third Party Advisory
https://backstage.forgerock.com/knowledge/kb/article/a92936505Mitigation, Third Party Advisory

Timeline

Published: Apr 9, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-7589?

How severe is CVE-2017-7589?

Severity scoring for CVE-2017-7589 is pending analysis. The EPSS model estimates a 1.02% probability of exploitation in the next 30 days.

How do I fix CVE-2017-7589?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-7589?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST