CVEvulnerability
CVE-2018-0696
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-02-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-640
Description
OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
Affected configurations
• osstech openam (>= 13.0 <= 13.0.0-120)
Related
Weakness · CWE (1)
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness
References
- http://jvn.jp/en/jp/JVN49995005/index.html Third Party Advisory
- https://www.cs.themistruct.com/report/wam20181012 Permissions Required, Third Party Advisory
- https://www.osstech.co.jp/support/am2018-4-1-en Third Party Advisory
- http://jvn.jp/en/jp/JVN49995005/index.html Third Party Advisory
- https://www.cs.themistruct.com/report/wam20181012 Permissions Required, Third Party Advisory
- https://www.osstech.co.jp/support/am2018-4-1-en Third Party Advisory