CVE-2019-13496

Опубликовано: 04 нояб. 2019

Источник: nvd

CVSS3: 8.1

CVSS2: 4.3

EPSS Низкий

Описание

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and replacing a failed SAML response with a successful SAML response.

Ссылки

https://github.com/FurqanKhan1/CVE-2019-13496
Exploit
Third Party Advisory
https://support.oneidentity.com/cloud-access-manager/kb/311391/cloud-access-manager-8-1-4-hotfix-1
Release Notes
Vendor Advisory
https://github.com/FurqanKhan1/CVE-2019-13496
Exploit
Third Party Advisory
https://support.oneidentity.com/cloud-access-manager/kb/311391/cloud-access-manager-8-1-4-hotfix-1
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:oneidentity:cloud_access_manager:*:*:*:*:*:*:*:*

Версия до 8.1.4 (исключая)

cpe:2.3:a:oneidentity:cloud_access_manager:8.1.4:-:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00633

Низкий

8.1 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-354

Связанные уязвимости

GHSA-q8jc-hpcv-jmxw