Vendor

    ForgeRock

    22 known vulnerabilities in products by ForgeRock, 1 of them actively exploited (CISA KEV).

    Key figures

    22

    Vulnerabilities

    1

    Actively exploited (KEV)

    1

    Used by ransomware

    9

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in ForgeRock
    CriticalCVE-2021-35464

    ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

    In CISA KEVRansomware

    		9.8
    HighCVE-2021-29156

    ForgeRock OpenAM: LDAP Injection

    		7.5
    CriticalCVE-2021-4201

    Pre-authentication session hijacking

    		9.6
    HighCVE-2016-6500

    Forgerock RACF Connector: Code Execution

    		8.1
    HighCVE-2016-10097

    ForgeRock OpenAM: XML External Entity (XXE)

    		7.5
    CriticalCVE-2021-37154

    ForgeRock Access Management: security vulnerability

    		9.8
    CriticalCVE-2021-37153

    ForgeRock Access Management: security vulnerability

    		9.8
    HighCVE-2019-3800

    CF CLI writes the client id and secret to config file

    also in 15 other products

    		6.3
    CriticalCVE-2022-3748

    Improper authorization that can lead to account impersonation

    		9.8
    CriticalCVE-2023-0511

    AM Java Policy Agent path traversal

    		9.1
    CriticalCVE-2023-0339

    AM Web Policy Agent path traversal

    		9.1
    CriticalCVE-2023-0582

    Path Traversal in ForgeRock Access Managment

    		8.1
    CriticalCVE-2022-0143

    LDAP Connector: When startTLS is used then LDAP connector ignores the wrong password

    		9.3
    MediumCVE-2018-7272

    ForgeRock Access Management: Information Disclosure

    		6.5
    HighCVE-2022-24670

    Any user can run unrestricted LDAP queries against a configuration endpoint

    		7.1
    MediumCVE-2017-14394

    ForgeRock Access Management: security vulnerability

    		6.1
    MediumCVE-2017-14395

    ForgeRock Access Management: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2020-17465

    ForgeRock Identity Manager: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2023-1656

    ForgeRock OpenIDM and Java Remote Connector Server (RCS): Cleartext Transmission of Sensitive Information

    		7.5
    MediumCVE-2022-24669

    Anonymous users can register / de-register for configuration change notifications

    		6.5
    MediumCVE-2024-25566

    Open Redirect in PingAM

    also in 1 other product

    		6.1
    Not ratedCVE-2014-7246

    ForgeRock OpenAM: Infinite Loop

    		—

    Products

    Products by ForgeRock
    ForgeRock Access Management161
    ForgeRock OpenAM61
    ForgeRock LDAP Connector30