CVE-2023-22320

OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Furthermore, a crafted URL may be evaluated incorrectly.

Score

CVSS 3.1 7.5 High

Status

Modified - vultures@jpcert.or.jp

Published

2023-01-10

Last modified

2025-04-07

Weaknesses

CWE-22

Affected products

• Openam (Openam)
• Openam Web Policy Agent Openam Consortium Edition (Openam Consortium)

References

• https://github.com/openam-jp/web-agents/issues/3
• https://jvn.jp/en/vu/JVN91740661/