Threats tagged 'ghsa-vvhj-w2jq-263q'

OpenAM Community Edition through version 16.0.6 contains an insufficient authorization and information exposure vulnerability in its session management endpoint. This flaw allows a low-privileged authenticated user to retrieve active session credentials of other users, including those with higher privileges. Exploitation requires a valid low-privilege session and knowledge of the target user's identity. The vulnerability is patched in version 16.1.1.