CVE-2017-7591 OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/use...
MediumCVSS 6.1
EPSS 0.68%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openidm project openidm | <= 4.0.0 | No fix listed |
| openidm project openidm | = 4.5.0 | No fix listed |
References
- www.rootlabs.com.br third-party-advisory
- backstage.forgerock.com mitigation third-party-advisory