Design/Logic Flaw

2019-11-0417:15:00

PRIOn knowledge base

www.prio-n.com

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.0%

JSON

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and replacing a failed SAML response with a successful SAML response.

CPENameOperatorVersion
cloud_access_managereq8.1.4
cloud_access_managerlt8.1.4

CPE	Name	Operator	Version
	cloud_access_manager	eq	8.1.4
	cloud_access_manager	lt	8.1.4

References

github.com/FurqanKhan1/CVE-2019-13496

support.oneidentity.com/cloud-access-manager/kb/311391/cloud-access-manager-8-1-4-hotfix-1