Description
OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM | < 16.1.4 | 16.1.4 |
References
- GitHub Security Advisory (GHSA-pw99-8h4m-p3gm) vendor-advisory
- VulnCheck Advisory: OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST third-party-advisory