Description
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM | < 16.1.3 | 16.1.3 |
References
- GitHub Security Advisory (GHSA-mw38-8gr7-c4x2) vendor-advisory
- VulnCheck Advisory: OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions third-party-advisory