CVE-2024-3484 is a medium severity flaw (CVSS 5.7) in OpenText iManager 3.2.6.0200: a path traversal flaw that the description says can lead to privilege escalation or file disclosure. The NetIQ release notes list it as resolved in iManager 3.2.6.0301, which is 3.2 Service Pack 6 Patch 3 Hotfix 1. Upgrade to that release or later.
What's affected
The record lists OpenText (formerly Micro Focus) iManager 3.2.6.0200, with patch levels 3.2.6 patch 1 and patch 2 also appearing in the product list. The weakness is CWE-22 (path traversal). The CVSS vector in the record says the attack is reached from an adjacent network, with low attack complexity, needing no privileges and some user interaction.
The NetIQ iManager 3.2 SP6 Patch 3 HotFix 1 release notes, dated April 2024, say the release resolves CVE-2024-3484 along with CVE-2024-3483 through CVE-2024-3488 and CVE-2024-3969. The fixed build is iManager 3.2.6.0301. The notes thank the reporter for disclosing file upload, request forgery, remote code execution, XXE, SSRF and path traversal issues. Related records in the same release: CVE-2024-3483, CVE-2024-3485, CVE-2024-3486, CVE-2024-3487, CVE-2024-3488. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
The record's CVSS score is the NVD value. If your scanner shows a different score, trust the vendor notes for the fix and use the score only for ordering the work.
How to check if you're exposed
Find each iManager server, including those installed alongside eDirectory or Identity Manager. Check the installed build in the iManager about information or the installed package list, and compare it with 3.2.6.0301.
Note the vendor's install warnings before upgrading. The release notes say 3.2.6.0301 is not supported with eDirectory 9.2.8 or later if both are installed on the same machine, and that upgrading on Identity Manager Engine 4.8.6 may hit a class loading error with a documented fix. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Inventory every iManager install and its build.
- Upgrade to iManager 3.2.6.0301 or later, after reading the release notes' install and compatibility warnings.
- Limit network access to iManager to a management network and named admin hosts.
- Review iManager and web server logs for unexpected requests or file uploads.
- Also confirm the other CVEs listed in the same release notes are covered by the upgrade.
Why it matters
iManager is an administration console for directory services, so it holds a great deal of trust in one place. Flaws in a console like this deserve attention even when scores are moderate, because the console can reach identity data and the machines it manages.
The weakness here is CWE-22 (path traversal). Fixing it means upgrading to the patch. Meanwhile, keep admin consoles on a management network, require strong authentication and limit who can reach them. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
One upgrade for all six iManager CVEs?
Per the release notes, iManager 3.2.6.0301 resolves CVE-2024-3483 through CVE-2024-3488 together, along with CVE-2024-3969. Read the notes for install caveats first.
Sources
Last reviewed: 19 October 2026.
