CVE-2016-10097

Published: Jan 2, 2017Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter.

Affected (1)

Products: Forgerock: Openam

Forgerock

1 product

Openam

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Forgerock Openam	Version 10.1.0

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (6)

http://www.cloudscan.me/2016/03/xxe-dork-open-am-1010-xml-injection.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/95174

Source: cve@mitre.org

https://twitter.com/h02332/status/816252923688665088

Source: cve@mitre.org

http://www.cloudscan.me/2016/03/xxe-dork-open-am-1010-xml-injection.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/95174

Source: af854a3a-2127-422b-91ae-364da2661108

https://twitter.com/h02332/status/816252923688665088

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.