CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41667 – OpenAM FreeMarker template injection
https://notcve.org/view.php?id=CVE-2024-41667
OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default PingOne Advanced Identity Cloud login page,they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4. • https://github.com/OpenIdentityPlatform/OpenAM/commit/fcb8432aa77d5b2e147624fe954cb150c568e0b8 https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-7726-43hg-m23v • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37471 – User impersonation using SAMLv1.x SSO in Open Access Management
https://notcve.org/view.php?id=CVE-2023-37471
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. • https://github.com/OpenIdentityPlatform/OpenAM/commit/7c18543d126e8a567b83bb4535631825aaa9d742 https://github.com/OpenIdentityPlatform/OpenAM/pull/624 https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-4mh8-9wq6-rjxg • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22320
https://notcve.org/view.php?id=CVE-2023-22320
OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Furthermore, a crafted URL may be evaluated incorrectly. • https://github.com/openam-jp/web-agents/issues/3 https://jvn.jp/en/vu/JVN91740661 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-34298
https://notcve.org/view.php?id=CVE-2022-34298
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." El módulo NT auth en OpenAM versiones anteriores a 14.6.6, permite un "ataque de reemplazo de nombre de usuario Samba" • https://github.com/watchtowrlabs/CVE-2022-34298 https://github.com/OpenIdentityPlatform/OpenAM/compare/14.6.5...14.6.6 https://github.com/OpenIdentityPlatform/OpenAM/pull/514 https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/14.6.6 •
CVSS: 7.5EPSS: 45%CPEs: 1EXPL: 5CVE-2021-29156 – OpenAM 13.0 - LDAP Injection
https://notcve.org/view.php?id=CVE-2021-29156
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key. ForgeRock OpenAM versiones anteriores a 13.5.1, permite la inyección LDAP por medio del protocolo Webfinger. Por ejemplo, un atacante no autenticado puede llevar a cabo la recuperación de caracteres del hash de contraseña, o recuperar un token de sesión o una clave privada • https://www.exploit-db.com/exploits/50480 https://github.com/guidepointsecurity/CVE-2021-29156 https://github.com/5amu/CVE-2021-29156 https://bugster.forgerock.org/jira/browse/OPENAM-10135 https://portswigger.net/research/hidden-oauth-attack-vectors • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •