A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway in version 2020.8.4 and earlier allows attackers with admin access to the Okta Access Gateway UI to execute OS commands as a privileged system account.
Okta Access Gateway version 2020.8.4 and earlier
The vulnerability is fixed in Okta Access Gateway version 2020.9.3 and newer. To remediate this vulnerability upgrade Okta Access Gateway.
CVE ID | |
Published Date | 2021-04-02 |
Vulnerability Type | Command Injection |
CWE | CWE-77 |
CVSS v3 | Score:6.7 Vector string:AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:H/RL:U/RC:C |
Okta would like to thank Jeremy Brown for responsibly reporting this vulnerability.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。