CVE-2024-4429 is a Medium (CVSS 5.4) cross site request forgery in OpenText iManager 3.2.6.0200, which the record says could lead to sensitive information disclosure. The linked release notes describe iManager 3.2.6.0301, but I did not find this CVE named in them. Confirm the fix with OpenText.
What's affected
- Product: OpenText (formerly NetIQ and Micro Focus) iManager, version 3.2.6.0200 named in the description.
- Fixed version: the record links the iManager 3.2 SP6 Patch 3 Hotfix 1 release notes, which describe version 3.2.6.0301. I read that page. It lists seven other CVEs it resolves and does not list CVE-2024-4429, so I cannot confirm that 3.2.6.0301 fixes this one. Ask OpenText.
- Severity: Medium, CVSS 5.4. The vector needs high privileges and user interaction, with a changed scope and high confidentiality impact.
- Exploitation: KEV is false.
How to check if you're exposed
Sign in to iManager and read the version in the about dialog, or check the installed package on the server. 3.2.6.0200 matches the record.
Ask who uses iManager. It is an administrative console for directory services, so the relevant users are directory administrators. CSRF needs one of them to visit a hostile page while logged in, so consider their browsing habits.
What to do now
- Find your iManager servers and versions.
- Install the current patch level and ask OpenText in writing whether it covers CVE-2024-4429.
- Have directory administrators use a separate browser profile for iManager, and log out when finished.
- Restrict iManager to an administration network.
- Review directory changes for entries nobody on the team recognizes.
Why it matters
The record maps this to CWE-352, cross site request forgery. The console accepts requests from a logged in administrator's browser without checking that the administrator meant to send them.
The score is moderate because the attack needs a privileged victim and a trick. But the changed scope reflects that the console controls a directory used by many systems, so the damage can extend beyond iManager itself.
Quick check
Does 3.2.6.0301 fix this CVE?
The release notes the record links do not name CVE-2024-4429 in the text I read. Ask OpenText before relying on it.
Who is at risk?
Administrators who use iManager and visit other sites in the same browser session.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4429 (published 2024-05-28) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
