Endpoint credential minting (insecure default allow-list)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenText Advanced Authentication Server, in multiple 6.4, 6.5, and 6.6 releases, is affected by this vulnerability. An insecure default configuration can let unauthenticated users create or recreate endpoints, allowing excessive resource allocation and potentially unauthorized credential issuance.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for this is issue is to create a secure configuration. The 6.6.2.0 release has a best practice entry if the configuration is unsecure. A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints. If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks. To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks. An empty whitelist will allow all networks to create/recreate endpoints.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- OpenText Advanced Authentication Server
From 6.4.0.0 · through 6.4.3.x; From 6.5.0.0 · through 6.5.0.x; From 6.6.0.0 · through 6.6.1.0