PT-2022-22114 · Openiam · Openam

Aliz Hammond · Published 2022-06-22 · Updated 2023-08-08 · CVE-2022-34298

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 14.6.6

Description The NT auth module in OpenAM allows a "replace Samba username attack." This issue may potentially be exploited to bypass authentication mechanisms.

Recommendations For versions prior to 14.6.6, update to version 14.6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the NT auth module until a patch is applied.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-34298

GHSA-PX3R-27QC-HX5G

Affected Products

Openam

References · 10

• https://github.com/OpenIdentityPlatform/OpenAM/compare/14.6.5...14.6.6 · Patch
• https://github.com/OpenIdentityPlatform/OpenAM/pull/514 · Patch
• https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/14.6.6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-34298 · Security Note
• https://osv.dev/vulnerability/GHSA-px3r-27qc-hx5g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34298 · Vendor Advisory
• https://github.com/OpenIdentityPlatform/OpenAM · Note
• https://t.me/cibsecurity/45016 · Telegram Post
• https://t.me/cvenotify/32045 · Telegram Post
• https://t.me/cvenotify/32686 · Telegram Post