Chat now with support
Chat with Support
Become a portal pro
Self Service Tools
Knowledge Base
My Account
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Support Essentials
Awards and Testimonials
Getting Started
License Agreement
Support Guide

Identity Manager Product Notification

Return
Critical Alerts
Vulnerability in DOMPurify in Identity Manager local HTML5 documentation.

How does this affect me?

When installing the Identity Manager Client Tools, there is an option to install a local HTML copy of the product documentation on the target server. The install is done by default on servers hosting Identity Manager Web Applications. 

This local documentation was created using a 3rd party tool by MadCap Software where recently a vulnerability in component DOMPurify version 3.0.8 has been detected. 

Resolution

Version specific Hotfixes have been created to address this issue. A transport package is provided along with a tool to import the transport package to install the hotfix.

It is recommended all customers using 9.0 LTS, 9.1.x, 9.2.x or 9.3.x ensure they are on a Supported Service Pack or the latest Cumulative Update and apply the hotfix on any servers hosting Identity Manager Web Applications, or that have the optional documentation installed. For more information and to download the hotfix, please see KB 4380318.

This issue will be resolved in all future releases.

We apologize for the inconvenience this issue may have caused.