CVE-2017-10873

HIGH

OpenAM Open Source Edition - Authentication Bypass via SAML 2.0 AuthnContext Handling

Title source: llm
STIX 2.1

Description

OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability affects OpenAM (Open Source Edition) implementations configured as SAML 2.0IdP, and switches authentication methods based on AuthnContext requests sent from the service provider.

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://www.cs.themistruct.com/
Third Party Advisory, VDB Entry third-party-advisory x_refsource_jvn
https://jvn.jp/en/jp/JVN79546124/
Patch, Vendor Advisory x_refsource_misc
https://www.osstech.co.jp/support/am2017-2-1-en

Scores

CVSS v3 8.1
EPSS 0.0262
EPSS Percentile 83.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-287
Status published
Products (2)
Open Source Solution Technology Corporation/OpenAM Open Source Edition
osstech/openam 9.5.5 - 9.5.5-41
Published Nov 02, 2017
Tracked Since Feb 18, 2026