CVE-2024-41667

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

The vulnerability of the getCustomLoginUrlTemplate method of the OpenAM access and rights management software allows a perpetrator to execute arbitrary code.

The vulnerability of the getCustomLoginUrlTemplate method in the OpenAM access and rights management software is related to improper code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

GHSA-7726-43HG-M23V OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

Template Injection

org.openidentityplatform.openam, openam-oauth2 is vulnerable to Template Injection. The vulnerability is due to improper template restrictions in the getCustomLoginUrlTemplate function within RealmOAuth2ProviderSettings.java, allowing attackers to inject and execute arbitrary code via the...

CVE-2024-41667

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

CVE-2024-41667

OpenAM

CVE-2024-41667 OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

CVE-2024-41667 OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

CVE-2024-41667 OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

PT-2024-5297 · Openiam · Openam

Name of the Vulnerable Software and Affected Versions: OpenAM versions 15.0.3 and prior Description: The issue is related to the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java, which is vulnerable to template injection due to its usage of user input. This vulnerability allow...

CVE-2024-41667: Improper Control of Generation of Code

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

OpenAM 安全漏洞

OpenAM is an all-in-one access management solution organized by the OpenAM Consortium. It provides authentication, authorization, delegation and federation capabilities. A security vulnerability exists in OpenAM version 15.0.3 and earlier versions, which stems from vulnerability to template...

User Impersonation

openam-federation-library is vulnerable to User Impersonation. The vulnerability exists because the processResponse function of SAMLUtils.java does not properly validate the signature of a SAML responses received as part of the SAMLv1.x Single Sign-On process, which allows an attacker to exploit...

OpenAM vulnerable to user impersonation using SAMLv1.x SSO process

Impact OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the...

GHSA-4MH8-9WQ6-RJXG OpenAM vulnerable to user impersonation using SAMLv1.x SSO process

Impact OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the...

CVE-2023-37471 User impersonation using SAMLv1.x SSO in Open Access Management

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-...

CVE-2023-37471

OpenAM up to version 14.7.2 is vulnerable to user impersonation due to improper validation of SAML responses in SAMLv1.x SSO. An attacker can impersonate any OpenAM user (including admin) by sending a crafted SAML response to the SAMLPOSTProfileServlet. A fix is available in OpenAM 14.7.3-SNAPSHO...

CVE-2023-37471 User impersonation using SAMLv1.x SSO in Open Access Management

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-...

CVE-2023-37471 User impersonation using SAMLv1.x SSO in Open Access Management

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-...