org.openidentityplatform.openam:openam-federation-library@14.6.2 vulnerabilities

latest version

15.1.3

latest non vulnerable version

15.1.3

first published

4 years ago

latest version published

2 months ago

licenses detected

(CC-BY-NC-ND-3.0 OR CDDL-1.0)
[14.5.2,)

package manager

View on Maven Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.openidentityplatform.openam:openam-federation-library package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
C Improper Authentication Affected versions of this package are vulnerable to Improper Authentication due to not properly validating the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the `SAMLPOSTProfileServlet` servlet. How to fix Improper Authentication? Upgrade `org.openidentityplatform.openam:openam-federation-library` to version 14.7.3 or higher.	[,14.7.3)

Improper Authentication

Affected versions of this package are vulnerable to Improper Authentication due to not properly validating the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet.

How to fix Improper Authentication?

Upgrade org.openidentityplatform.openam:openam-federation-library to version 14.7.3 or higher.

[,14.7.3)

Go back to all versions of this package