lint fix
parent
44d23ef3eb
commit
8c7ec49185
|
@ -7,7 +7,7 @@ info:
|
||||||
tags: cve,cve2021,openam,ldap,injection
|
tags: cve,cve2021,openam,ldap,injection
|
||||||
description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval.
|
description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval.
|
||||||
remediation: Upgrade to OpenAM commercial version 13.5.1 or later.
|
remediation: Upgrade to OpenAM commercial version 13.5.1 or later.
|
||||||
reference:
|
reference:
|
||||||
https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md
|
https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md
|
||||||
https://hackerone.com/reports/1278050
|
https://hackerone.com/reports/1278050
|
||||||
https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/
|
https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/
|
||||||
|
|
Loading…
Reference in New Issue