org.openidentityplatform.opendj:opendj-server-legacy 5.0.2

Direct Vulnerabilities

Known vulnerabilities in the org.openidentityplatform.opendj:opendj-server-legacy package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Authorization Bypass Through User-Controlled Key Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SASL PLAIN authentication process. An attacker can gain unauthorized access to arbitrary directory user accounts by supplying an authorization identity (`authzid`) that resolves to a different user, provided they possess the proxied-auth privilege but lack the required proxy ACI scope grant. This allows impersonation of any resolvable non-root identity beyond intended access controls. How to fix Authorization Bypass Through User-Controlled Key? Upgrade `org.openidentityplatform.opendj:opendj-server-legacy` to version 5.1.2 or higher.	[,5.1.2)
C Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JMX RMI connector. An attacker can execute arbitrary code on the server by sending specially crafted serialized Java objects prior to authentication. Note: This is only exploitable if the JMX Connection Handler is enabled and the attacker has TCP network access to the configured listener. How to fix Deserialization of Untrusted Data? Upgrade `org.openidentityplatform.opendj:opendj-server-legacy` to version 5.1.1 or higher.	[,5.1.1)

Vulnerability

Vulnerable Version

Authorization Bypass Through User-Controlled Key

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SASL PLAIN authentication process. An attacker can gain unauthorized access to arbitrary directory user accounts by supplying an authorization identity (authzid) that resolves to a different user, provided they possess the proxied-auth privilege but lack the required proxy ACI scope grant. This allows impersonation of any resolvable non-root identity beyond intended access controls.

How to fix Authorization Bypass Through User-Controlled Key?

Upgrade org.openidentityplatform.opendj:opendj-server-legacy to version 5.1.2 or higher.

[,5.1.2)

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JMX RMI connector. An attacker can execute arbitrary code on the server by sending specially crafted serialized Java objects prior to authentication.

Note: This is only exploitable if the JMX Connection Handler is enabled and the attacker has TCP network access to the configured listener.

How to fix Deserialization of Untrusted Data?

Upgrade org.openidentityplatform.opendj:opendj-server-legacy to version 5.1.1 or higher.

[,5.1.1)

org.openidentityplatform.opendj:opendj-server-legacy@5.0.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically