Access Management

An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks

Published: 2024-10-29T15:34:53.358Z
Updated: 2024-10-29T19:58:25.775Z

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.

Published: 2024-03-27T17:09:43.769Z
Updated: 2025-04-14T17:03:58.780Z

Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0.

Published: 2023-04-14T14:06:30.571Z
Updated: 2025-04-14T17:03:55.384Z

An attacker can use the unrestricted LDAP queries to determine configuration entries

Published: 2022-10-27T16:53:00.019Z
Updated: 2025-05-09T19:17:19.956Z

It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services.

Published: 2022-10-27T16:53:56.378Z
Updated: 2025-05-06T18:33:31.107Z

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.

Published: 2022-02-14T21:04:29.132Z
Updated: 2025-04-14T17:03:52.274Z

In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.

Published: 2021-08-25T20:02:53.000Z
Updated: 2024-08-04T01:16:03.158Z

ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue.

Published: 2021-08-25T20:05:54.000Z
Updated: 2024-08-04T01:16:03.966Z

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

Published: 2021-07-22T17:10:18.000Z
Updated: 2025-10-21T23:25:39.887Z

The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.

Published: 2018-02-21T00:00:00.000Z
Updated: 2024-09-17T03:03:02.319Z

Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS.

Published: 2019-06-19T21:22:29.000Z
Updated: 2024-08-05T19:27:40.077Z

OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.

Published: 2019-06-19T21:22:20.000Z
Updated: 2024-08-05T19:27:40.465Z