Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.openidentityplatform.opendj:opendj-server-legacy | maven | <= 5.1.1 | 5.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the PlainSASLMechanismHandler.processSASLBind method, which failed to perform a necessary 'mayProxy' ACI scope check when a SASL PLAIN bind included an authzid for a different user. The patch introduces a checkProxyAccess method within PlainSASLMechanismHandler that calls a new, shared SASLContext.hasProxyAccess method. This new method centralizes the proxy access control logic, ensuring that both SASL PLAIN and other mechanisms like DIGEST-MD5/GSSAPI consistently enforce the ACI scope grant. The SASLContext.hasPermission method was also modified to use this new shared logic, making it a relevant part of the patched code path, although the primary vulnerability was the lack of the check in PlainSASLMechanismHandler.
org.opends.server.extensions.PlainSASLMechanismHandler.processSASLBindopendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java
org.opends.server.extensions.SASLContext.hasPermissionopendj-server-legacy/src/main/java/org/opends/server/extensions/SASLContext.java