CyberRota Analysis
AI-GeneratedOpenAM versions prior to 16.1.1 are vulnerable due to a flaw in the GroovySandboxValueFilter, which allows authenticated server-side script authors to bypass security restrictions and execute operating-system commands. This can lead to unauthorized access and potential compromise of the Java Virtual Machine (JVM) and all realms managed by the application. Organizations using OpenAM for access management should prioritize upgrading to version 16.1.1 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit a script in an executed context can invoke operating-system commands as the OpenAM application server account, crossing the realm-scoped administration boundary and compromising the JVM and every realm it serves. This issue is fixed in version 16.1.1.