OpenAM versions prior to 16.1.4 have an open redirect and cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to manipulate post-login and logout redirect destinations via the 'goto' and 'gotoOnFail' parameters. Exploitation can lead to redirecting users to phishing sites or executing malicious scripts in the XUI interface to steal session cookies.
OpenAM versions prior to 16.1.4 have a server-side request forgery (SSRF) vulnerability in the certificate CRL checking process. This flaw allows attackers with a trusted CA-signed certificate to make OpenAM fetch certificate revocation lists (CRLs) from arbitrary internal hosts without destination restrictions or signature verification. Exploitation can lead to credential exposure, revocation data manipulation to block certificate authentication, and denial of service by tying up authentication threads.
OpenAM versions from 14.0.0 up to but not including 16.1.4 have an information disclosure vulnerability. This flaw allows unauthenticated attackers to read live session tokens via the notification WebSocket by bypassing agent-only checks through an unvalidated internal forward on legacy Liberty ID-FF endpoints. Exploitation can lead to hijacking of user and administrator sessions.
OpenAM versions before 16.1.4 have an authentication bypass vulnerability in the SAML v2.0 service provider. This flaw allows unauthenticated remote attackers to submit forged unsigned assertions on specific bindings when WantAssertionsSigned is false, enabling them to impersonate any mapped user, including administrators, and hijack single sign-on sessions.
OpenAM versions prior to 16.1.4 contain a critical vulnerability where the Valid Creation Attributes list is not enforced during self-registration. This flaw allows anonymous attackers to set restricted attributes, including group membership, enabling them to join administrative groups and gain full administrative control of the OpenAM system.
OpenIdentityPlatform OpenAM versions before 16.1.4 contain an open redirect vulnerability. This occurs because certain logout and authentication pages do not validate destination URLs against an allowed list, enabling attackers to craft links that redirect users to arbitrary external sites, potentially facilitating phishing attacks. The vulnerability has a medium severity with a CVSS score of 4.7.
OpenAM versions prior to 16.1.4 have an open redirect vulnerability due to improper validation of the RelayState parameter when no relayStateUrlList is configured. This flaw allows attackers to craft single sign-on links that redirect users from the trusted OpenAM domain to external malicious sites, potentially enabling phishing attacks and bypassing URL filters.
OpenAM versions before 16.1.4 and its client SDK have a vulnerability in the internal server-to-server SOAP communication channel where responses are not sufficiently validated. This flaw allows attackers positioned on the network to impact the integrity and availability of the system. Specifically, attackers who can intercept unencrypted traffic or control a site server may crash receiving processes, tamper with writable files, and potentially execute code.
Tornado versions prior to 6.6 have a path traversal vulnerability in the RequestHandler.static_url() and get_version() methods. This flaw allows attackers who can control input to static_url() to use ../ sequences to hash files outside the intended static_path directory. Attackers can obtain SHA-512 hashes of readable files to confirm their existence or reference special files like /dev/zero to cause a denial of service by blocking the event loop indefinitely.
OpenAM versions prior to 16.1.4 have a server-side request forgery (SSRF) vulnerability. This flaw allows attackers registering UMA resource sets to cause OpenAM to make internal network requests by specifying unvalidated scope description URLs. The vulnerability can be exploited to probe internal hosts or cloud metadata endpoints when OpenAM sends pending-request notification emails.
OpenAM versions prior to 16.1.4 have a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. This can disrupt authentication, session validation, and policy decision processes.
OpenAM versions prior to 16.1.4 have an open redirect vulnerability in the SAML 1.x single sign-on implementation. This flaw allows remote attackers to redirect authenticated users to attacker-controlled phishing sites by exploiting loose matching of trusted partner destinations in URLs to /SAMLAwareServlet or /SAMLPOSTProfileServlet.
OpenAM versions prior to 16.1.4 have an incomplete output encoding vulnerability related to SAML 1.x identity providers. This flaw allows a trusted identity provider to inject unencoded content into the service provider's auto-submitted form, potentially altering attribute values. The vulnerability undermines the integrity of attributes received by the target application. The CVSS score is low, reflecting limited impact on confidentiality and availability, with some integrity impact. No patch links or fixed versions are explicitly provided in the data.
Tornado versions prior to 6.6 do not validate the max_age argument in the RequestHandler.set_cookie method and related cookie-setting methods. This flaw allows an attacker to inject additional Set-Cookie attributes by supplying malicious input as max_age. Such attributes can include Domain, Path, or Secure, potentially expanding the cookie's scope to parent paths or other subdomains. The vulnerability has a medium severity rating with a CVSS score of 4.2.
OpenAM versions before 16.1.4 have a stored cross-site scripting (XSS) vulnerability that allows privileged attackers to inject malicious scripts via a user's display name. When a victim views the OAuth 2.0 / OpenID Connect consent page, the injected script executes and can steal the victim's OpenAM session cookie, enabling user impersonation.
OpenAM versions before 16.1.4 have a vulnerability in the verification of signed SAML 1.x assertions or responses. The software does not ensure that the signature on a SAML assertion or response matches the partner named as its issuer, allowing acceptance of signatures from any certificate in OpenAM's keystore. This flaw enables an attacker with access to a private key of a trusted SAML 1.x partner to forge assertions that impersonate other partners and sign in as their users, including privileged accounts.
A credential disclosure vulnerability exists in gix-fs component of gitoxide before version 0.24.1. Remote attackers can exploit this by supplying UNC symlink targets in a crafted repository. When a user checks out this repository on Windows with symlinks enabled, the vulnerability causes SMB authentication to leak NTLM credentials including username, domain, and NTLMv2 hash.
A denial of service vulnerability exists in gix-commitgraph before version 0.42.0, as used in gitoxide before 0.61.0. The issue arises because the commit-graph parser does not properly validate parent graph positions against the declared commit count and fails to check the EDGE chunk length for 4-byte alignment. This can cause panics that abort operations such as gix merge-base, gix blame, and other applications embedding gix when processing a crafted .git/objects/info/commit-graph file.
OpenAM versions prior to 16.1.4 contain a server-side request forgery (SSRF) vulnerability. This flaw allows administrators, including delegated realm administrators, to cause the server to fetch arbitrary URLs via the federation configuration wizard metadata URLs. Malicious metadata or OpenID Connect discovery URLs can be used to probe internal network hosts or cloud metadata endpoints, potentially exposing partial response data.
OpenAM versions prior to 16.1.4 do not enforce PKCE in the OAuth 2.0 device authorization flow, failing to validate the code verifier when exchanging device codes for tokens. This allows attackers who obtain an approved device code from client logs or shared device storage to redeem it for access and ID tokens, potentially impersonating the user.