Access Management
Vendor:
First CVE: Feb 21, 2018 · Active for 8 years
12
Total CVEs
More Total CVEs than 90% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
8.1
Avg CVSS
Higher Avg CVSS than 70% of tracked products
8.3%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Access Management over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 21, 2018
8 years ago
Most Recent CVE
Oct 29, 2024
633 days ago
CVE Severity & Scoring
Access Management12 CVEs
50%
50%
All CVEs352,231 CVEs
45%
40%
11%
MediumCritical
Attack Vector
Local0 (0.0%)
Network12 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None9 (75.0%)
Unknown0 (0.0%)
Required3 (25.0%)
Privileges Required
Low2 (16.7%)
High0 (0.0%)
None10 (83.3%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-35464CRITICAL ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and r | Jul 22, 2021 | 9.8 | 99 | YES | YES |
CVE-2022-3748CRITICAL Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0. | Apr 14, 2023 | 9.8 | 31 | NO | NO |
CVE-2021-4201CRITICAL Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially | Feb 14, 2022 | 9.8 | 31 | NO | NO |
CVE-2021-37154CRITICAL In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion. | Aug 25, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-37153CRITICAL ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue. | Aug 25, 2021 | 9.8 | 30 | NO | NO |
CVE-2023-0582CRITICAL Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass.
This issue affects access | Mar 27, 2024 | 9.8 | 29 | NO | NO |
CVE-2022-24669MEDIUM It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services. | Oct 27, 2022 | 6.5 | 23 | NO | NO |
CVE-2018-7272MEDIUM The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file. | Feb 21, 2018 | 6.5 | 23 | NO | NO |
CVE-2017-14395MEDIUM Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid | Jun 19, 2019 | 6.1 | 21 | NO | NO |
CVE-2017-14394MEDIUM OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invali | Jun 19, 2019 | 6.1 | 21 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (12 CVEs).
CISA KEV
1 CVE
8.3% of CVEs· 97th percentile
Metasploit
1 CVE
8.3% of CVEs· 97th percentile
Nuclei
1 CVE
8.3% of CVEs· 97th percentile
ExploitDB
1 CVE
8.3% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (12 CVEs).
Media Mentions
Signals from CVEs in this product scope (12 CVEs).
Top CNAs Publishing CVEs For Access Management
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 7.5.0 | 1 | 6.1 | 0.2% | 0 | 0 |
| 7.4.1 | 1 | 6.1 | 0.2% | 0 | 0 |
| 7.4.0 | 1 | 6.1 | 0.2% | 0 | 0 |
| 7.3.1 | 1 | 6.1 | 0.2% | 0 | 0 |
| 7.3.0 | 1 | 6.1 | 0.2% | 0 | 0 |
| 7.2.0 | 1 | 9.8 | 0.8% | 0 | 0 |
| 7.1.1 | 1 | 6.5 | 0.5% | 0 | 0 |
| 7.1.0 | 3 | 7.6 | 1.0% | 0 | 0 |
| 7.0.2 | 1 | 9.8 | 2.0% | 0 | 0 |
| 7.0.1 | 1 | 9.8 | 2.0% | 0 | 0 |
| 7.0.0 | 1 | 9.8 | 2.0% | 0 | 0 |
| 6.5.4 | 2 | 6.5 | 0.4% | 0 | 0 |
| 6.5.3 | 3 | 7.6 | 1.0% | 0 | 0 |
| 6.5.2.3 | 1 | 9.8 | 2.0% | 0 | 0 |
| 6.5.2.2 | 1 | 9.8 | 2.0% | 0 | 0 |
| 6.5.2.1 | 1 | 9.8 | 2.0% | 0 | 0 |
| 6.5.1 | 3 | 7.6 | 1.0% | 0 | 0 |
| 6.5.0.2 | 1 | 9.8 | 2.0% | 0 | 0 |
| 6.5.0.1 | 1 | 9.8 | 2.0% | 0 | 0 |
| 6.5.0 | 1 | 9.8 | 2.0% | 0 | 0 |