From 8c7ec49185e7a777c2b3b088d77e15f9c2b1c78a Mon Sep 17 00:00:00 2001 From: sandeep Date: Tue, 25 Jan 2022 22:08:01 +0530 Subject: [PATCH] lint fix --- cves/2021/CVE-2021-29156.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cves/2021/CVE-2021-29156.yaml b/cves/2021/CVE-2021-29156.yaml index 357475e128..fa05456c95 100644 --- a/cves/2021/CVE-2021-29156.yaml +++ b/cves/2021/CVE-2021-29156.yaml @@ -7,7 +7,7 @@ info: tags: cve,cve2021,openam,ldap,injection description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval. remediation: Upgrade to OpenAM commercial version 13.5.1 or later. - reference: + reference: https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md https://hackerone.com/reports/1278050 https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/