SQL injection detection during ADSGroup update job (4369697)

SQL injection detection during ADSGroup update job

Updates to an ADSGroup within Identity Manager results in the ADHOC update job freezing in the job queue with the following error:

SQL injection by brute force attack detected in WHERE clause: (UID_DPRNamespace in (select UID_DPRNamespace from DPRNamespace where (Ident_DPRNamespace = N'ADS') or (AdditionalSystemTypes like N'%ADS%'))) and (ObjectKeyBase = '<Key><T>ADSGroup</T><P>group guid</P></Key>')

Product defect

WORKAROUND:
Follow the steps below to lower the calculated risk in Designer.

1. Login to Designer with an applicable account
2. Click on Edit configuration parameters
3. Expand QBM\SQLCheck\RiskEvaluation
4. Set the value to Low
5. Click on Commit to database
6. Click the Save button

STATUS:
Issue fixed in version in 8.2.1. The latest version of Identity Manager can be downloaded here

35356

Defect 35356 affects 8.2