Chat now with support
Chat with Support

We are currently experiencing a OneLogin Outage within the US region, please consult https://www.onelogin.com/status for further details.

Self Service Tools
Knowledge Base
My Account
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Support Essentials
Awards and Testimonials
License Agreement
Support Guide

Active Roles Product Notification

Return
Critical Alerts
Critical Notification

Active Roles 7.4.x and 7.5.x

 

A security vulnerability was discovered in one of the authentication components that may be used when logging into the Active Roles Web Interface. This vulnerability could allow an attacker to gain unauthorized access. 

How does this affect me?

If you have installed and configured the Redistributable STS component by following the section located in Appendix E of the Active Roles Administration Guide (versions 7.4.x and 7.5) and your users authenticate against an identity provider STS such as Microsoft ADFS, Microsoft Azure AD, Okta, or Ping Federate you may be affected by this security vulnerability.

Resolution 

A security fix has been released for Active Roles 7.4.x and 7.5. if you have installed and configured the Redistribute STS component as described above, we recommend this patch be applied. 

If you have not installed the Redistributable STS and are using the default IIS Windows authentication to log into the Active Roles Web Interface, you would not be affected.

Status

A hotfix for Active Roles versions 7.4.x and 7.5 is now available. Please review KB 337963 for further details on this issue. 

We apologize for the inconvenience this issue may have caused.