CVE-2024-3970 is a medium severity flaw in OpenText iManager 3.2.6.0200, scored 5.3 by NVD. The record describes a server side request forgery that could lead to sensitive information disclosure by directory traversal. The only linked source is the iManager 3.2.6 Patch 3 Hotfix 1 release note, so apply that hotfix or later and confirm the fix there.
What's affected
The record names OpenText iManager 3.2.6.0200, with CPE entries for the 3.2.6 base release and its patch levels. iManager is the web administration console for NetIQ eDirectory, which explains the Micro Focus vendor name in the CPE data.
The record does not state a fixed version in its own text. Its single reference is the release note for iManager 3.2.6 Patch 3 Hotfix 1, which points to that hotfix as the fix vehicle. This write-up did not fetch the page, so read it to confirm that this CVE is listed and which build closes it.
The vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N. It needs local access, high complexity and a high privilege login, with a changed scope, which explains the medium rating. The KEV flag is false and the record reports no exploitation.
The NVD record is dated 2024-05-15 and carries the vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N, a score of 5.3 (Medium). Weakness class: CWE-918.
How to check if you're exposed
Find the iManager version in the web console under the About or Help menu, or in the install directory on the host. Compare it with the build named in the Patch 3 Hotfix 1 release notes.
Check every eDirectory administration host, because iManager is often installed once and left alone, which is how old builds survive for years. Then check who can reach the console, since placing it on a restricted management network narrows who can try anything at all.
Free dependency scanning needs no account: paste a manifest into the in-browser scan to see which known CVEs apply to the libraries you ship. The Gold directory lists each CVE with its affected packages.
What to do now
- Inventory every iManager instance and record its build.
- Apply iManager 3.2.6 Patch 3 Hotfix 1 or later, after reading the release notes to confirm this CVE is covered.
- Restrict the iManager web console to an administrative network and to named administrators.
- Review administrator rights in eDirectory and remove accounts that do not need them.
- Back up the configuration before patching, following the vendor's guidance.
Why it matters
The weakness is server side request forgery, CWE-918. The server can be made to request a location of the attacker's choosing, and the response may reveal data from places the attacker could not reach directly. The record adds that directory traversal is involved in the disclosure.
Defences include an allow list of destinations for any server side fetch and network rules that stop management consoles from reaching sensitive internal services.
iManager administers a directory service, so a compromise tends to reach identities and access rules, not just one application. Four iManager CVEs were published in the same period, so treat the hotfix as covering a set and check each one in the release notes.
Quick check
Which release fixes CVE-2024-3970?
The record gives no version. Its reference is the Patch 3 Hotfix 1 release note, so confirm the fix status there.
Is it exploited in the wild?
The KEV flag is false and the record reports no exploitation.
Sources
Last reviewed: 19 October 2026.
