Path Traversal Vulnerability in OpenAM Web Policy Agent by OpenAM Consortium
CVE-2023-22320

7.5HIGH

Key Information:

Vendor: Openam Consortium
Status: Openam Web Policy Agent (openam Consortium Edition)
Vendor: CVE Published:; 10 January 2023

🔔 Create Openam Consortium Vulnerability Alert

What is CVE-2023-22320?

The OpenAM Web Policy Agent, provided by the OpenAM Consortium, suffers from a path traversal vulnerability due to improper parsing of URLs. An attacker can manipulate crafted URLs that may be evaluated incorrectly, potentially allowing unauthorized access to sensitive files and directories within the web server, thereby compromising the integrity and confidentiality of the system.

Affected Version(s)

OpenAM Web Policy Agent (OpenAM Consortium Edition) 4.1.0

References

https://github.com/openam-jp/web-agents/issues/3

https://jvn.jp/en/vu/JVN91740661/

third-party-advisory

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 10, 2023
Vulnerability Reserved
Dec 28, 2022

CVE-2023-22320 Data

JSON