Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Policy Agent: all versions up to 5.10.1
OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Furthermore, a crafted URL may be evaluated incorrectly.
This project (i.e. Web Policy Agent) is in a limbo state at the moment as we have not touched it since the fork was created. This CVE needs to be addressed when we migrate it to Wren Security.
Ref: https://nvd.nist.gov/vuln/detail/CVE-2023-0339
Ref: https://nvd.nist.gov/vuln/detail/CVE-2023-22320
This project (i.e. Web Policy Agent) is in a limbo state at the moment as we have not touched it since the fork was created. This CVE needs to be addressed when we migrate it to Wren Security.