CVE-2018-0696 Business logic in OpenAM
Authenticated attackers can manipulate session management to change security questions and reset passwords, leading to account takeover in OpenAM.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-0696?
CVE-2018-0696 is a high-severity vulnerability in OpenAM, published on 13 Feb 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
Weakness: CWE-640
Which versions are affected by CVE-2018-0696?
It affects 1 product.
Products include Osstech Openam.
How do I fix CVE-2018-0696?
No fix has been published for CVE-2018-0696 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-0696 being exploited?
There is no known exploitation of CVE-2018-0696 in the wild and no public exploit code.
Other vulnerabilities in OpenAM
Sources
Also known as GHSA-mp8r-jgrr-9j4x.