Okta Access Gateway vulnerabilities
5 known vulnerabilities in Okta Access Gateway from Okta. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing…
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service accoun
- 8.1 High severity
Okta Access Gateway: Improper Authentication
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console
- 9.9 Critical severity
Okta Access Gateway: Improper Neutralization of Special Elements used in an SQL Command
The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting
- 7.2 High severity
Okta Access Gateway: Improper Neutralization of Directives in Dynamically Evaluated Code
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of th
- 7.2 High severity
Okta Access Gateway: Improper Control of Generation of Code
The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives.