Lucene search

[email protected]CVE-2017-10873

HistoryNov 02, 2017 - 3:29 p.m.

CVE-2017-10873

2017-11-0215:29:00

CWE-287

[email protected]

web.nvd.nist.gov

cve-2017-10873

openam

open source

authentication bypass

unauthorized access

saml 2.0idp

authncontext

security vulnerability

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.7%

JSON

OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability affects OpenAM (Open Source Edition) implementations configured as SAML 2.0IdP, and switches authentication methods based on AuthnContext requests sent from the service provider.

Affected configurations

NVD

Node

osstechopenamRange9.5.5–9.5.5-41open_source

osstechopenamRange11.0.0–11.0.0-112open_source

osstechopenamRange13.0.0–13.0.0-73open_source

CPENameOperatorVersion
osstech:openamosstech openamle9.5.5-41
osstech:openamosstech openamle11.0.0-112
osstech:openamosstech openamle13.0.0-73

CPE	Name	Operator	Version
osstech:openam	osstech openam	le	9.5.5-41
osstech:openam	osstech openam	le	11.0.0-112
osstech:openam	osstech openam	le	13.0.0-73

CNA Affected

[
  {
    "product": "OpenAM",
    "vendor": "Open Source Solution Technology Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Open Source Edition"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN79546124/

www.cs.themistruct.com/

www.osstech.co.jp/support/am2017-2-1-en

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.7%

JSON

Related for CVE-2017-10873

nvd1 prion1 jvn1 ubuntucve1 cvelist1