CVE-2017-10873
Last modified
CVE-2017-10873 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability affects OpenAM (Open Source Edition) implementations configured as SAML 2.0IdP, and switches authentication methods based on AuthnContext requests sent from the service provider.. EPSS estimates a 2.63% chance of exploitation in the next 30 days.
Description
OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability affects OpenAM (Open Source Edition) implementations configured as SAML 2.0IdP, and switches authentication methods based on AuthnContext requests sent from the service provider.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Osstech | Openam | >= 9.5.5, <= 9.5.5-41 |
| Osstech | Openam | >= 11.0.0, <= 11.0.0-112 |
| Osstech | Openam | >= 13.0.0, <= 13.0.0-73 |
References
- https://jvn.jp/en/jp/JVN79546124/Third Party Advisory, VDB Entry
- https://www.cs.themistruct.com/Third Party Advisory
- https://www.osstech.co.jp/support/am2017-2-1-enPatch, Vendor Advisory
- https://jvn.jp/en/jp/JVN79546124/Third Party Advisory, VDB Entry
- https://www.cs.themistruct.com/Third Party Advisory
- https://www.osstech.co.jp/support/am2017-2-1-enPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-10873?
How severe is CVE-2017-10873?
How do I fix CVE-2017-10873?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-10868H2O version 2.2.2 and earlier allows remote attackers to cau…7.5
- CVE-2017-10869Buffer overflow in H2O version 2.2.2 and earlier allows remo…
- CVE-2017-1087In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.…
- CVE-2017-10870Memory corruption vulnerability in Rakuraku Hagaki (Rakuraku…
- CVE-2017-10871Buffer overflow in NTT DOCOMO Wi-Fi STATION L-02F Software v…
- CVE-2017-10872H2O version 2.2.3 and earlier allows remote attackers to cau…
- CVE-2017-10874PWR-Q200 does not use random values for source ports of DNS …
- CVE-2017-10875I-O DATA DEVICE LAN DISK Connect Ver2.02 and earlier allows …
- CVE-2017-1088In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE…
- CVE-2017-10885Untrusted search path vulnerability in HYPER SBI Ver. 2.2 an…
- CVE-2017-10886Cross-site scripting vulnerability in CS-Cart Japanese Editi…
- CVE-2017-10887Untrusted search path vulnerability in BOOK WALKER for Windo…
Are you affected by CVE-2017-10873?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST