Reflected cross-site scripting (XSS) In org.openidentityplatform.openam:openam-federation-library
Description
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via FSUtils.postToTarget
Summary
Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without authentication.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 16.1.1 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.