Veille CVE

‹ Retour à la liste

CVE-2026-47424

7.5 Élevée

Publiée le 15/09/2026 à 12:17 · Modifiée le 23/09/2026 à 20:21 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit a script in an executed context can invoke operating-system commands as the OpenAM application server account, crossing the realm-scoped administration boundary and compromising the JVM and every realm it serves. This issue is fixed in version 16.1.1.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 7.5 Élevée security-advisories@github.com CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Faiblesses (CWE)

Références

Ailleurs