org.openidentityplatform.openam:openam-fedlet-unconfigured-war (>=14.5.2 <=14.7.2), org.openidentityplatform.openig:openig-doc (>=5.0.9 <=5.0.11) +1 more potentially affected by CVE-2023-37471 via org.openidentityplatform.openam:openam-federation-library (>=14.5.2 <=14.7.2)

org.openidentityplatform.openam:openam-federation-library MAVEN version =14.5.2, =14.5.2, =5.0.9, =5.0.9, =5.0.11 Source cves: CVE-2023-37471 Source advisory: OSV:GHSA-4MH8-9WQ6-RJXG...

CVE-2023-37471

OpenAM up to version 14.7.2 is vulnerable to user impersonation due to improper validation of SAML responses in SAMLv1.x SSO. An attacker can impersonate any OpenAM user (including admin) by sending a crafted SAML response to the SAMLPOSTProfileServlet. A fix is available in OpenAM 14.7.3-SNAPSHO...