GHSA-XQR9-4WVV-GVCH OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl

Summary A realm admin of tenant B can read the profile, client roles, and realm roles of any user in any other realm including the master realm by supplying the target user's UUID in the REST API path. Three read endpoints in UserResourceImpl check whether the caller holds the read:admin role but...

CVE-2022-31860

An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule...

PT-2022-20961 · Unknown · Openremote

Name of the Vulnerable Software and Affected Versions: OpenRemote versions prior to 1.0.5 Description: An issue in OpenRemote allows attackers to execute arbitrary code via a crafted Groovy rule. Recommendations: For OpenRemote versions prior to 1.0.5, update to version 1.0.5 or later to resolve...