CVE-2021-35464criticalunder attackransomwareCWE-502

CVE-2021-35464

Published · Updated

Follow this CVE+ Monitor Access Management

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDJul 22
1st PoCJul 1
metasploitJun 29
CISA KEV+104d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

ForgeRock AM servers before version 7.0 contain a critical flaw that allows attackers to execute malicious code remotely without needing a password. An attacker can exploit this by sending a specially crafted request to the server, taking advantage of how the application processes Java data.

Technical detail

Java deserialization vulnerability in the jato.pageSession parameter across multiple endpoints, exploitable via unauthenticated /ccversion/* requests. The vulnerability stems from unsafe deserialization in Sun ONE Application Framework (JATO) on Java 8 and earlier versions, allowing remote code execution without authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.