ForgeRock AM远程代码执行漏洞（CVE-2021-35464）

🗓️ 05 Jul 2021 00:00:00Reported by KnownsecType

Pre-auth RCE in ForgeRock OpenAM server - a popular access management solution for web applications. Unsafe Java deserialization in the Jato framework used by OpenAM allows RCE thanks to a serialized Java object. Exploit involves generating the object using ysoserial and base64url encoding. Vulnerability affects older versions of ForgeRock OpenAM but not the latest version 7.1

Reporter	Title	Published	Views	Family All 47
0day.today	ForgeRock Access Manager / OpenAM 14.6.3 - Remote Code Execution (Unauthenticated) Exploit	16 Jul 202100:00	–	zdt
GithubExploit	Exploit for Deserialization of Untrusted Data in Forgerock Access_Management	1 Jul 202103:51	–	githubexploit
ICS	2021 Top Routinely Exploited Vulnerabilities	28 Apr 202212:00	–	ics
ATTACKERKB	CVE-2026-33439	7 Apr 202620:46	–	attackerkb
ATTACKERKB	Pre-auth RCE in ForgeRock Access Manager (CVE-2021-35464)	22 Jul 202100:00	–	attackerkb
Information Security Automation	Last Week’s Security news: PrintNightmare, Kaseya, Intune, Metasploit Docker escape	5 Jul 202115:19	–	avleonov
Information Security Automation	Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins	19 Jul 202116:29	–	avleonov
Circl	CVE-2021-35464	29 Jun 202113:17	–	circl
CISA KEV Catalog	ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability	3 Nov 202100:00	–	cisa_kev
CISA	Critical ForgeRock Access Management Vulnerability	12 Jul 202100:00	–	cisa