CVE-2016-10097
HighSummary
OpenAM 10.1.0 has an XXE (XML External Entity) vulnerability in the path /SSOPOST/metaAlias/%realm%/idpv2, allowing remote attackers to read arbitrary files via the SAMLRequest parameter.
Risk Assessment
This vulnerability could lead to the exposure of sensitive data from the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update OpenAM to the latest version and implement appropriate security measures to mitigate the risk of XXE attacks.
Other vulnerabilities in OpenAM 10.1.0
See all- CVE-2026-33439Critical
OpenAM prior to 16.0.6 is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter, bypassing the WhitelistObjectInputStream mitigation applied to jato.pageSession after CVE-2021-35464.
- CVE-2023-37471Critical
OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses in the SSO process, allowing attackers to impersonate any OpenAM user, including the administrator.
Original NVD description (English source)
XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter.