CVE-2021-4201criticalCWE-284

CVE-2021-4201: critical vulnerability in ForgeRock Access Management

Pre-authentication session hijacking

Published · Updated

Follow this CVE+ Monitor Access Management

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.6epss 2.0%
Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
ForgeRock · Access Management
Related CVEs — ForgeRock Access Management

In the same product, most dangerous first.

CVE-2022-24670HIGHAny user can run unrestricted LDAP queries against a configuration endpointEPSS 0.7%CVE-2022-24669MEDIUMAnonymous users can register / de-register for configuration change notificationsEPSS 0.4%