CVE-2018-0696 OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified...
HighCVSS 7.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| osstech openam | >= 13.0, <= 13.0.0-120 | No fix listed |
| OpenAM consortium OpenAM | = 13.0 and later | No fix listed |
References
- JVN#49995005 third-party-advisory
- www.cs.themistruct.com permissions-required third-party-advisory
- www.osstech.co.jp third-party-advisory