CVE-2017-7589: In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by t...

Security readout for executives and security teams

This CVE describes an OpenIDM information disclosure issue. An anonymous request to the info endpoint could receive a successful JSON response containing sensitive details such as IP address strings. The public bundle does not provide CVSS, CWE, or confirmed affected product metadata beyond the OpenIDM version statement. Exposure is most likely in legacy OpenIDM deployments matching the described version range with the info endpoint reachable by anonymous users. Public internet exposure would increase concern, but the supplied sources do not confirm typical deployment patterns or affected configurations. Treat this as a targeted legacy-platform exposure check rather than an emergency based on current evidence. Prioritize if OpenIDM is internet-facing or supports identity workflows, because unauthenticated disclosure from identity infrastructure can assist follow-on attacks. Mitigation focus: Identify any OpenIDM deployments through 4.0.0 and before 4.5.0.; Check ForgeRock or successor vendor guidance for the corrected version or configuration change.; Restrict anonymous access to the info endpoint where operationally possible..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.