199 matches found
org.openidentityplatform.openam:openam-fedlet-unconfigured-war (>=14.5.2 <=14.7.2), org.openidentityplatform.openig:openig-doc (>=5.0.9 <=5.0.11) +1 more potentially affected by CVE-2023-37471 via org.openidentityplatform.openam:openam-federation-library (>=14.5.2 <=14.7.2)
org.openidentityplatform.openam:openam-federation-library MAVEN version =14.5.2, =14.5.2, =5.0.9, =5.0.9, =5.0.11 Source cves: CVE-2023-37471 Source advisory: OSV:GHSA-4MH8-9WQ6-RJXG...
OpenAM vulnerable to user impersonation using SAMLv1.x SSO process
Impact OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the...
GHSA-4MH8-9WQ6-RJXG OpenAM vulnerable to user impersonation using SAMLv1.x SSO process
Impact OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the...
CVE-2023-37471 User impersonation using SAMLv1.x SSO in Open Access Management
Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-...
CVE-2023-37471
OpenAM up to version 14.7.2 is vulnerable to user impersonation due to improper validation of SAML responses in SAMLv1.x SSO. An attacker can impersonate any OpenAM user (including admin) by sending a crafted SAML response to the SAMLPOSTProfileServlet. A fix is available in OpenAM 14.7.3-SNAPSHO...
CVE-2023-37471 User impersonation using SAMLv1.x SSO in Open Access Management
Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-...
CVE-2023-37471 User impersonation using SAMLv1.x SSO in Open Access Management
Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-...
K000132352: OpenAM Vulnerability CVE-2023-22320
Security Advisory Description OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerabilityCWE-22. Furthermore, a crafted URL may be evaluated incorrectly. CVE-2023-22320 Impact There is no impact; F5 products are...
OpenAM Web Policy Agent (OpenAM Consortium Edition) vulnerable to path traversal
Overview OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability CWE-22. Furthermore, a crafted URL may be evaluated incorrectly. OpenAM Consortium reported this vulnerability to JPCERT/CC to notify users of...
CVE-2023-22320
OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerabilityCWE-22. Furthermore, a crafted URL may be evaluated incorrectly...
Path traversal
OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerabilityCWE-22. Furthermore, a crafted URL may be evaluated incorrectly...
UBUNTU-CVE-2023-22320
OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerabilityCWE-22. Furthermore, a crafted URL may be evaluated incorrectly...
PT-2023-18428 · Openam Consortium · Openam Web Policy Agent
Name of the Vulnerable Software and Affected Versions: OpenAM Web Policy Agent OpenAM Consortium Edition affected versions not specified Description: The issue is related to improper URL parsing, leading to a path traversal vulnerability. A crafted URL may be evaluated incorrectly, potentially...
CVE-2023-22320
OpenAM Web Policy Agent (OpenAM Consortium Edition) is affected by a path traversal vulnerability (CWE-22) due to improper URL parsing. The CVE-2023-22320 entry has a CVSSv3.1 base score of 7.5 (HIGH; NETWORK attacker, no user interaction). Connected documents confirm the issue is tied to URL han...
CVE-2023-22320
OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerabilityCWE-22. Furthermore, a crafted URL may be evaluated incorrectly...
CVE-2023-22320
OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerabilityCWE-22. Furthermore, a crafted URL may be evaluated incorrectly...
OpenAM 路径遍历漏洞
OpenAM is an all-in-one access management solution organized by the OpenAM Consortium. It provides authentication, authorization, delegation, and federation capabilities. A security vulnerability exists in the OpenAM Web Policy Agent that stems from improperly parsing a URL, resulting in a path...
CVE-2023-22320
OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerabilityCWE-22. Furthermore, a crafted URL may be evaluated incorrectly...
CVE-2023-22320
OpenAM Web Policy Agent OpenAM Consortium Edition provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerabilityCWE-22. Furthermore, a crafted URL may be evaluated incorrectly...
