Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage
Vulnerability Description
A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.
CVSS Information
N/A
Vulnerability Type
将资源暴露给错误范围
Vulnerability Title
One Identity OneLogin AD Connector 安全漏洞
Vulnerability Description
One Identity OneLogin AD Connector是美国One Identity公司的一个连接器软件。 One Identity OneLogin AD Connector存在安全漏洞，该漏洞源于云基础设施配置不当导致日志数据泄露。
CVSS Information
N/A
Vulnerability Type
N/A