Maximthomas

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/*' using an unverified session identifier and a specific class name. This can lead to server crashes, classpath probing, or potential remote code execution through gadget chains, which are sequences of existing code fragments used to achieve an unintended goal. **Recommendations** Update to version 16.1.3 or later. Restrict access to the '/jaxrpc/*' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when `cookieHashRedirectEnabled` is set, potentially allowing script execution in the OpenAM origin. However, an unrelated HTTP 500 failure prevents exploitation in released versions. **Recommendations** Update to version 16.1.3 or later. As a temporary mitigation, ensure the `cookieHashRedirectEnabled` setting is disabled.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** An email content injection issue allows unauthenticated attackers to control the wording of notification emails. This is possible through the `forgotPassword` and `register` actions on the '/json/{realm}/users' endpoint. By supplying the `subject` and `message` fields, attackers can send phishing emails using the organization's configured From address or use the registration process as a relay to send emails to arbitrary recipients. **Recommendations** Update to version 16.1.3 or later. Restrict access to the '/json/{realm}/users' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** An open redirect issue exists where unauthenticated attackers can redirect users by providing an unverified `id token hint` to the '/oauth2/connect/endSession' endpoint. By specifying any realm client in a forged hint, attackers can redirect victims to any registered post-logout URI, which can be used to facilitate phishing attacks by leveraging the trust associated with the OpenAM host. **Recommendations** Update to version 16.1.3 or later. As a temporary mitigation, restrict access to the '/oauth2/connect/endSession' endpoint or avoid using the `id token hint` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** The OAuth2 Provider PKCE enforcement is only applied to authorization requests where the `response type` is exactly code. Consequently, codes issued via OpenID Connect hybrid flows (such as `code token`, `code id token`, or `code token id token`) are not bound to a challenge. This allows an attacker who intercepts such a code to redeem it for tokens of a public client using any non-empty `code verifier`. PKCE (Proof Key for Code Exchange) is a security extension used to prevent authorization code injection attacks. **Recommendations** Update OpenAM to version 16.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** An authorization bypass exists in the sessions REST endpoint query operation. This issue allows users with delegated RealmAdmin privileges to list sessions across different realms by supplying a ` queryFilter` that specifies another realm. This can lead to the disclosure of usernames, universal IDs, and session handles across tenant boundaries. **Recommendations** Update to version 16.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** An improper authorization issue exists where delegated administrators can destroy sessions outside their assigned realms. This occurs because realm checks are performed using the requester's realm rather than the target session's realm. Authenticated accounts possessing the `iplanet-am-session-destroy-sessions` attribute can provide a target session identifier or handle to forcibly log out users across any realm. **Recommendations** Update to version 16.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** A server-side request forgery (SSRF) issue exists where attackers with permissions to register or modify OAuth 2.0 clients can force the server to fetch internal resources. This occurs through the use of an unvalidated `jwks uri` variable. By leveraging client-authentication and ID-token validation, unauthenticated fetches can be triggered to probe internal hosts, metadata endpoints, or local files, or to cause a denial of service by exhausting request threads. **Recommendations** Update to version 16.1.3 or later.