AM
Product
Access Management
On CISA KEVExploited in the wildRansomware-linked
12
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 0Medium 6Low 0
Watch
Add Access Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-35464 RansomwareIn wildKEV | 9.8 | Jul 22 | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability Affected: before 6.5.4 |
| CVE-2023-0582 | 9.8 | Mar 27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass Affected: before 7.1.4; 7.2.0 |
| CVE-2022-3748 | 9.8 | Apr 14 | Improper Authorization vulnerability in ForgeRock Inc Affected: 6.5.0 through 7.2.0 |
| CVE-2021-4201 | 9.8 | Feb 14 | Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially… Affected: 5.5.2; 6.0.0; 6.0.0.1; 6.0.0.2; 6.0.0.3; 6.0.0.4; +14 more |
| CVE-2021-37154 | 9.8 | Aug 25 | In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion Affected: before 7.0.2 |
| CVE-2021-37153 | 9.8 | Aug 25 | ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue Affected: 6.0.0 before 7.0.2 |
| CVE-2022-24669 | 6.5 | Oct 27 | Anonymous users can register / de-register for configuration change notifications Affected: before 6.5.5; before 7.1.2; before 7.2.0 |
| CVE-2022-24670 | 6.5 | Oct 27 | Any user can run unrestricted LDAP queries against a configuration endpoint Affected: before 6.5.5; before 7.1.2; before 7.2.0 |
| CVE-2018-7272 | 6.5 | Feb 21 | The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file Affected: before 5.5.0 |
| CVE-2024-25566 | 6.1 | Oct 29 | An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs Affected: through 7.0.2; 7.1.0 through 7.1.4; 7.2.0 through 7.2.2; 7.3.0; 7.3.1; 7.4.0; +2 more |
| CVE-2017-14395 | 6.1 | Jun 19 | Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some… Affected: 5.0.0 through 5.1.1 |
| CVE-2017-14394 | 6.1 | Jun 19 | OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some… Affected: 5.0.0 through 5.1.1 |
Showing 12