CVE-2023-37471

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374726.5Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior san CVE-2023-374738.8zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused th CVE-2023-374747.5Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder.CVE-2023-374757.5Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to CVE-2023-374767.8OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger CVE-2023-374778.81Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel fir CVE-2023-374789.8pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when in CVE-2023-374797.5Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environmen CVE-2023-37487.5A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an at CVE-2023-374804.9Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vuln CVE-2023-374814.9Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vuln CVE-2023-374825.3The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated re