Vendor
OpenIdentityPlatform
54 known vulnerabilities.
22 results · Clear filters · Feed
-
Medium 6.5
OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login
OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote att…
-
Medium 6.5
OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point
OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signatur…
-
Medium 4.7
OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages
OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed …
-
Medium 4.7
OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState
OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayStat…
-
Medium 6.1
OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail
OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redi…
-
Medium 6.8
OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel
OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a…
-
Medium 6.8
OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow
OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can re…
-
Medium 4.7
OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching
OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProf…
-
Medium 4.8
OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name
OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name exe…
-
Medium 6.6
OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation
OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.…
-
Medium 5.0
OpenAM before 16.1.4 SSRF via UMA Scope Description URLs
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing …
-
Medium 4.1
OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter …
-
Medium 5.4
OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. Attackers can trigger unauthenticated fetches thr…
-
Medium 4.9
OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-s…
-
Medium 4.9
OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter nam…
-
Medium 4.7
OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to r…
-
Medium 6.8
OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge…
-
Medium 6.1
OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fie…
-
Medium 6.1
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests coul…
-
Medium 6.1
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a craf…
-
Medium 6.1
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. A…
-
Medium 5.3
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application clien…