Threats Tagged 'ghsa-wg5r-wc3x-39vc'

Open Access Management (OpenAM) versions prior to 16.1.2 contain a critical vulnerability in the pre-authentication /authservice PLL endpoint. This endpoint accepts a CustomCallback XML element that allows an attacker to specify an arbitrary Java class for instantiation without verifying interface implementation. The default configuration exposes this endpoint without authentication, enabling unsafe deserialization and remote code execution on the server. The vulnerability is fixed in version 16.1.2.