Code injection

2017-02-0319:59:00

PRIOn knowledge base

www.prio-n.com

8.2 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.3%

JSON

Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnObjFlag set to true, which allows remote attackers to execute arbitrary code via a crafted serialized Java object, aka LDAP entry poisoning.

CPENameOperatorVersion
racf_connectorle1.1.0.0

CPE	Name	Operator	Version
	racf_connector	le	1.1.0.0

References

backstage.forgerock.com/knowledge/kb/article/a96963547