Description
OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM | < 16.1.4 | 16.1.4 |
References
- GitHub Security Advisory (GHSA-6gg2-2v5m-454x) vendor-advisory
- VulnCheck Advisory: OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel third-party-advisory