User impersonation using SAMLv1.x SSO in Open Access Management (OpenIdentityPlatform OpenAM)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.26 % · percentile 70 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details.
Weaknesses (CWE)
- CWE-287 — Improper Authentication
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | GitHub_M |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-4mh8-9wq6-rjxg — OpenAM vulnerable to user impersonation using SAMLv1.x SSO process
European references
- ENISA EUVD · EUVD-2023-1953
- GCVE · GCVE-0-2023-37471
Affected configurations (NVD CPE)
cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*< 14.7.3
Affected products
| Product | Versions |
|---|---|
| OpenIdentityPlatform · OpenAM | affected < 14.7.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |