AM
Product
Access Management
On CISA KEVExploited in the wildRansomware-linked
12
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 0Medium 6Low 0
Watch
Add Access Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-24669 | 6.5 | Oct 27 | Anonymous users can register / de-register for configuration change notifications Affected: before 6.5.5; before 7.1.2; before 7.2.0 |
| CVE-2022-24670 | 6.5 | Oct 27 | Any user can run unrestricted LDAP queries against a configuration endpoint Affected: before 6.5.5; before 7.1.2; before 7.2.0 |
| CVE-2018-7272 | 6.5 | Feb 21 | The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file Affected: before 5.5.0 |
| CVE-2024-25566 | 6.1 | Oct 29 | An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs Affected: through 7.0.2; 7.1.0 through 7.1.4; 7.2.0 through 7.2.2; 7.3.0; 7.3.1; 7.4.0; +2 more |
| CVE-2017-14395 | 6.1 | Jun 19 | Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some… Affected: 5.0.0 through 5.1.1 |
| CVE-2017-14394 | 6.1 | Jun 19 | OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some… Affected: 5.0.0 through 5.1.1 |
Showing 6