PatchTheCVEopeniam vulnerabilities and fixes
Recent CVEs affecting openiam, with upgrade or downgrade steps. 5 tracked.
openiam has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2021-04-06. Highest priority: CVE-2020-13420 (score 60/100).
- CVE-2020-13422 HIGH 8.1 UPGRADE OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/* administrat
- CVE-2020-13421 CRITICAL 9.8 UPGRADE OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password
- CVE-2020-13420 CRITICAL 9.8 UPGRADE OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script.
- CVE-2020-13419 MEDIUM 5.3 UPGRADE OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task.
- CVE-2020-13418 MEDIUM 6.1 UPGRADE OpenIAM before 4.2.0.3 allows XSS in the Add New User feature.
FAQ
How do I fix openiam vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is openiam being exploited right now?
None of the tracked openiam CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which openiam CVE should I patch first?
CVE-2020-13420 currently ranks highest (60/100): OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script..