The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding username on a Windows client machine.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Artiva_architect | Ontariosystems | 3.2-mr5 (including) | 3.2-mr5 (including) |
| Artiva_healthcare | Ontariosystems | 5.2-mr5 (including) | 5.2-mr5 (including) |
| Artiva_rm | Ontariosystems | 3.1-mr7 (including) | 3.1-mr7 (including) |
| Artiva_workstation | Ontariosystems | 1.3.0 (including) | 1.3.0 (including) |