Access Management@* Security Vulnerabilities and Issues — Access Management@* CVE List

Lucene search

ForgerockAccess Management*

4 matches found

CVE•added 2021/07/22 6:15 p.m.•1176 views

CVE-2021-35464

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability...

10CVSS9.7AI score0.94386EPSS

In wildWeb

CVE•added 2024/03/27 6:15 p.m.•74 views

CVE-2023-0582

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.

9.8CVSS8.5AI score0.00035EPSS

CVE•added 2021/08/25 9:15 p.m.•52 views

CVE-2021-37154

In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.

10CVSS9.4AI score0.00534EPSS

CVE•added 2018/02/21 12:29 a.m.•30 views

CVE-2018-7272

The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.

6.5CVSS6.1AI score0.00294EPSS