Threats tagged 'ghsa-p77m-vcv9-2h7q'

OpenAM versions prior to 16.1.4 have a server-side request forgery (SSRF) vulnerability. This flaw allows attackers registering UMA resource sets to cause OpenAM to make internal network requests by specifying unvalidated scope description URLs. The vulnerability can be exploited to probe internal hosts or cloud metadata endpoints when OpenAM sends pending-request notification emails.