CVE-2019-13498

HIGH

One Identity Cloud Access Manager 8.1.3 - Cleartext Transmission of Sensitive Information

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-13498. PoCs published by FurqanKhan1.

AI-analyzed exploit summary This repository provides a detailed technical explanation of how CVE-2019-13498, a missing HSTS vulnerability, can be exploited via MITM attacks using bettercap to steal credentials and OTPs. It includes a JavaScript injection snippet and step-by-step instructions for conducting the attack.

Description

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks. This issue is fixed in version 8.1.4.

Exploits (1)

nomisec WRITEUP 9 stars
by FurqanKhan1 · poc
https://github.com/FurqanKhan1/CVE-2019-13498

This repository provides a detailed technical explanation of how CVE-2019-13498, a missing HSTS vulnerability, can be exploited via MITM attacks using bettercap to steal credentials and OTPs. It includes a JavaScript injection snippet and step-by-step instructions for conducting the attack.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: OneIdentity Cloud Access Manager 8.1.3
No auth needed
Prerequisites: Network access to the victim's traffic · Bettercap tool installed · Victim using a vulnerable version of the software
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.4
EPSS 0.0122
EPSS Percentile 64.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-319
Status published
Products (1)
oneidentity/cloud_access_manager 8.1.3
Published Jul 29, 2019
Tracked Since Feb 18, 2026