CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41667 – OpenAM FreeMarker template injection
https://notcve.org/view.php?id=CVE-2024-41667
OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default PingOne Advanced Identity Cloud login page,they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4. • https://github.com/OpenIdentityPlatform/OpenAM/commit/fcb8432aa77d5b2e147624fe954cb150c568e0b8 https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7726-43hg-m23v • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37471 – User impersonation using SAMLv1.x SSO in Open Access Management
https://notcve.org/view.php?id=CVE-2023-37471
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. • https://github.com/OpenIdentityPlatform/OpenAM/commit/7c18543d126e8a567b83bb4535631825aaa9d742 https://github.com/OpenIdentityPlatform/OpenAM/pull/624 https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-4mh8-9wq6-rjxg • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-34298
https://notcve.org/view.php?id=CVE-2022-34298
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." El módulo NT auth en OpenAM versiones anteriores a 14.6.6, permite un "ataque de reemplazo de nombre de usuario Samba" • https://github.com/watchtowrlabs/CVE-2022-34298 https://github.com/OpenIdentityPlatform/OpenAM/compare/14.6.5...14.6.6 https://github.com/OpenIdentityPlatform/OpenAM/pull/514 https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/14.6.6 •