Login Request a demo
Critical severity · published Jul 22, 2021
CVE-2021-35464
ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
RansomwareIn wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueNov 17, 2021
Ransomware campaign useKnown
Affected products
Which versions
AM
Access Management · Forgerock
before 6.5.4 · source: NVD
OP
Openam · Forgerock
9.0.0 before 14.6.3 · source: NVD
AM
Access Management (AM) · ForgeRock
All versions, or not specified · source: KEV
Affected product
AM
Access Management
Forgerock
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-35464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-35464
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://bugster.forgerock.org
x_refsource_MISC
http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html
x_refsource_MISC
http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html
x_refsource_CONFIRM
https://backstage.forgerock.com/knowledge/kb/article/a47894244
More from Access Management
9.8
CVE-2023-0582
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass
9.8
CVE-2022-3748
Improper Authorization vulnerability in ForgeRock Inc
9.8
CVE-2021-4201
Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially…
9.8
CVE-2021-37154
In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion
9.8
CVE-2021-37153
ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue