CVE-2018-0696

EPSS 1.1%

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Feb 2019Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.

Affected products

OpenAM Consortium · OpenAM

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://jvn.jp/en/jp/JVN49995005/index.html https://www.cs.themistruct.com/report/wam20181012 https://www.osstech.co.jp/support/am2018-4-1-en