CVE-2016-10097

概要

参考情報

• cloudscan.me/2016/03/xxe-dork-open-am-1010-xml-injection.html
• securityfocus.com/bid/95174
• twitter.com/h02332/status/816252923688665088

openam のその他の脆弱性

• CVE-2021-35464緊急 9.8悪用確認済み（CISA KEV）ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitatio…
• CVE-2021-29156高 7.5ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform charac…
• CVE-2017-14395中 6.1Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctl…
• CVE-2017-14394中 6.1OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correct…
• CVE-2014-7246低 3.5The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-ser…