Threats tagged 'ghsa-r9pv-5rpp-vm8g'

OpenAM Community Edition through version 16.0.6 contains an information exposure vulnerability in its Cross-Domain Single Sign-On (CDSSO) servlet. This flaw allows a logged-in user's raw session token to be sent via POST to an attacker-controlled URL if the user is induced to visit a crafted link. The vulnerability requires user interaction and a non-default configuration where CDSSO is enabled. It was fixed in version 16.1.1.