High · 7.5 CVE-2023-22320 EUVD-2023-26483GHSA-q9vj-6cqq-wmgg

OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulne…

Published Jan 10, 2023 · Updated Apr 7, 2025 · Assigned by jpcert

Vendor: OpenAM Consortium Product: OpenAM Web Policy Agent (OpenAM Consortium Edition)

Description

OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Furthermore, a crafted URL may be evaluated incorrectly.

Affected products

Vendor	Product	Affected	Fixed
OpenAM consortium	OpenAM Web Policy Agent (OpenAM Consortium Edition)	4.1.0	—

References

https://github.com/openam-jp/web-agents/issues/3
OpenAM Web Policy Agent (OpenAM Consortium Edition) vulnerable to path traversal third-party-advisory