CVE-2017-7591

OpenIDM versions 4.0.0 and 4.5.0 are affected by a reflected cross-site scripting (XSS) vulnerability in the Admin UI, reachable via the _sortKeys parameter to the authzRoles script under managed/user/. The root cause is an reflected XSS in the Admin UI input handling, enabling an attacker-suppli...

CVE-2017-7589

OpenIDM prior to 4.5.0 (4.0.0–pre-4.5.0) exposes an info endpoint vulnerability: an anonymous user can trigger information disclosure via the info/login.js path due to a missing access-control check. Reports indicate responses may be 200 OK containing JSON with IP addresses, indicating partial co...

CVE-2017-7590

ForgeRock OpenIDM Admin UI (versions 4.0.0 and 4.5.0) is vulnerable to persistent cross-site scripting (XSS) via a crafted Managed Object Name, allowing script injection in the Admin UI. This label is supported by multiple sources (NVD/CVE-2017-7590 description; CNVD-2017-30828; OSV/PRION entries...