Openiam

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Openiam records in CISA KEV

No Openiam vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

5 records in Openiam · all components

TI-2020-10524 CVE-2020-13420 · GHSA-gwpg-rphc-vhpm

MEDIUM 46

OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02104 Published 2021-04-06 No fix listed

TI-2020-10525 CVE-2020-13421 · GHSA-hjj2-x4c3-xqp4

MEDIUM 44

OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01174 Published 2021-04-06 No fix listed

TI-2020-10526 CVE-2020-13422 · GHSA-7hgc-cjwg-52r6

LOW 37

OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/* administrative actions.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00876 Published 2021-04-06 No fix listed CWE-862

TI-2020-10522 CVE-2020-13418 · GHSA-m7p8-f9pq-2762

LOW 28

OpenIAM before 4.2.0.3 allows XSS in the Add New User feature.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00643 Published 2021-04-06 No fix listed CWE-79

TI-2020-10523 CVE-2020-13419 · GHSA-9fhm-p455-w3wg

LOW 27

OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01262 Published 2021-04-06 No fix listed CWE-22