Vulnerabilities

TI-2020-10526 CVE-2020-13422 · GHSA-7hgc-cjwg-52r6

OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform…

LOW 37

OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/* administrative actions.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00876 Published 2021-04-06 No fix listed CWE-862

TI-2020-10525 CVE-2020-13421 · GHSA-hjj2-x4c3-xqp4

MEDIUM 44

OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01174 Published 2021-04-06 No fix listed

TI-2020-10523 CVE-2020-13419 · GHSA-9fhm-p455-w3wg

LOW 27

OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01262 Published 2021-04-06 No fix listed CWE-22

TI-2020-10522 CVE-2020-13418 · GHSA-m7p8-f9pq-2762

LOW 28

OpenIAM before 4.2.0.3 allows XSS in the Add New User feature.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00643 Published 2021-04-06 No fix listed CWE-79

TI-2020-10524 CVE-2020-13420 · GHSA-gwpg-rphc-vhpm

MEDIUM 46

OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02104 Published 2021-04-06 No fix listed