Skip to main content
Version: Omada Identity on-premises 15.0.x Long-term support (LTS)

Resolved Issues and Bug Fixes

Read more about resolved issues and bug fixes in this release.

Patch 2 (15.0.7.x)​

Microsoft.Kiota dependencies updated​

We updated the Microsoft.Kiota dependencies to version 1.22.0 or later to address a high-severity open redirect vulnerability affecting OE Service and RoPE. All Kiota packages are aligned to the same version.

Microsoft.AspNet.OData dependency updated​

We updated Microsoft.AspNet.OData to version 7.8.0 or later to address a high-severity vulnerability in the OData API dependency. The update is compatible with the OData components used by Omada Identity.

BouncyCastle.Cryptography dependency updated​

We updated the mail dependencies to resolve a critical vulnerability in BouncyCastle.Cryptography. The v15 LTS patch includes BouncyCastle.Cryptography version 2.7.0 or later.

Patch 1 (15.0.6.15)​

Unsanitized Open Redirect via RURL parameter​

We've removed the usage of the RURL request parameter in Main.aspx page.

CSRF vulnerability​

We've improved CSRF origin validation on state changing requests.

Revert application string to defaults is not recorded as a changeset​

We've fixed a problem where reverting application strings was not recorded as a changeset.

info

The Revert to defaults action in Application Strings no longer attempts to revert Data Object Type (DOT) multilingual property values to their default values. To modify DOT multilingual property values, use the Mass Edit option.

info

Reverting application strings only affects translations stored in the database. Custom translation files are not modified. For more information, refer to the Translations section.

INC-307262

Archiving DataObjectVersion stalls for hours due to AuditTrail archiving​

Previously, the Archive process unnecessarily prevented the short and long archive cycles from running at the same time, even though they are independent operations. The cycles now run concurrently as intended, improving archive throughput.

INC-311618

Resolved SQL security finding​

A possible SQL query vulnerability has been resolved by implementing parameterized queries. No exposure or customer impact occurred before the fix.

INC-312778