本ページは forgerock access_management に影響する公開済み CVE（NVD の CPE 経由で関連付け）を列挙します。各行に深刻度指標・概要・公開日が含まれます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-25566 | An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks | [email protected] | 5.1 | 0.22% | 2024-10-29 | 2026-06-17 |
| CVE-2023-0582 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2. | [email protected] | 8.1 | 0.78% | 2024-03-27 | 2026-06-17 |
| CVE-2022-3748 | Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0. | [email protected] | 9.8 | 0.91% | 2023-04-14 | 2026-06-17 |
| CVE-2022-24670 | An attacker can use the unrestricted LDAP queries to determine configuration entries | [email protected] | 7.1 | 0.55% | 2022-10-27 | 2026-06-17 |
| CVE-2022-24669 | It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services. | [email protected] | 6.5 | 0.36% | 2022-10-27 | 2026-06-17 |
| CVE-2021-4201 | Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions. | [email protected] | 9.6 | 1.95% | 2022-02-14 | 2026-06-17 |
| CVE-2021-37154 | In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion. | [email protected] | 9.8 | 1.36% | 2021-08-25 | 2026-06-17 |
| CVE-2021-37153 | ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue. | [email protected] | 9.8 | 1.16% | 2021-08-25 | 2026-06-17 |
| CVE-2021-35464 KEV | ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier | [email protected] | 9.8 | 100.00% | 2021-07-22 | 2026-06-16 |
| CVE-2017-14395 | Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS. | [email protected] | 6.1 | 0.79% | 2019-06-19 | 2026-06-16 |
| CVE-2017-14394 | OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect. | [email protected] | 6.1 | 0.79% | 2019-06-19 | 2026-06-16 |
| CVE-2018-7272 | The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file. | [email protected] | 6.5 | 0.89% | 2018-02-20 | 2026-06-16 |