CyberRota Analysis
AI-GeneratedOpenAM's MSISDN authentication module is vulnerable due to improper handling of user-supplied MSISDN values, allowing unauthenticated remote attackers to inject LDAP filter metacharacters into search queries. This critical flaw can lead to unauthorized access, enabling attackers to obtain authenticated sessions without needing a password. Organizations using versions prior to 16.1.1, particularly those with the MSISDN module enabled, should prioritize upgrading to mitigate this severe security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.