CVE-2016-10097

Description

References

• cloudscan.me/2016/03/xxe-dork-open-am-1010-xml-injection.html
• securityfocus.com/bid/95174
• twitter.com/h02332/status/816252923688665088

openam의 다른 취약점

• CVE-2021-35464심각 9.8EXPLOITED (CISA KEV)ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitatio…
• CVE-2021-29156높음 7.5ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform charac…
• CVE-2017-14395보통 6.1Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctl…
• CVE-2017-14394보통 6.1OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correct…
• CVE-2014-7246낮음 3.5The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-ser…