Threats tagged 'ghsa-6c99-87fr-6q7r'

A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module, affecting versions prior to 16.1.1. Exploitation requires that an attacker can write attacker-controlled data to a storage attribute read by the WebAuthn module, which is not the default configuration but possible in some deployments. Successful exploitation allows arbitrary code execution as the application server user. The issue is patched in OpenAM Community Edition version 16.1.1.