Lucene search

K
vulnrichmentForgeRockVULNRICHMENT:CVE-2023-0582
HistoryMar 27, 2024 - 5:09 p.m.

CVE-2023-0582 Path Traversal in ForgeRock Access Managment

2024-03-2717:09:43
CWE-22
ForgeRock
github.com
cve-2023-0582
forgerock access management
path traversal
authorization bypass
access management 7.3.0
access management 7.2.1
access management 7.1.4
access management 7.0.2

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.8

Confidence

High

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in ForgeRock Access Management allows Authorization Bypass.

This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.

CNA Affected

[
  {
    "vendor": "forgerock",
    "product": "access management",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "7.3.0",
        "versionType": "major release"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "7.2.1",
        "versionType": "maintenance release"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "7.1.4",
        "versionType": "maintenance release"
      },
      {
        "status": "affected",
        "version": "0",
        "versionType": "maintenance release",
        "lessThanOrEqual": "7.0.2"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:forgerock:access_management:7.3.0:*:*:*:*:*:*:*"
    ],
    "vendor": "forgerock",
    "product": "access_management",
    "versions": [
      {
        "status": "unaffected",
        "version": "7.3.0"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*"
    ],
    "vendor": "forgerock",
    "product": "access_management",
    "versions": [
      {
        "status": "affected",
        "version": "7.2.0",
        "lessThan": "7.2.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.1.3",
        "lessThan": "7.1.4",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "7.0.2"
      }
    ],
    "defaultStatus": "unknown"
  }
]

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.8

Confidence

High

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Related for VULNRICHMENT:CVE-2023-0582