CVE-2021-35464

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

Affected products

Aws, Forgerock Access Management, Forgerock Openam, Java, Sun One Application Framework

Forgerock Access Management

< 6.5.4

Forgerock Openam

< 14.6.3

Fix

Available

CVSS 2.0

10.0 HIGH

CVSS 3.1

9.8 CRITICAL

EPSS

100.0% (100th percentile)

Weakness

CWE-502

NVD status

Analyzed

Published

2021-07-22