Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2021-4201
PUBLISHED
More InfoOfficial Page
Assigner-ForgeRock
Assigner Org ID-6b18ae97-0aab-4af2-9ba4-74b2b139ddfa
View Known Exploited Vulnerability (KEV) details
Published At-14 Feb, 2022 | 21:04
Updated At-14 Apr, 2025 | 17:03
Rejected At-
▼CVE Numbering Authority (CNA)
Pre-authentication session hijacking

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.

Affected Products
Vendor
ForgeRock, Inc.ForgeRock
Product
Access Management
Versions
Affected
  • From 7.1 before 7.1.1 (custom)
  • From 6.5 before 6.5.4 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-284CWE-284 Improper Access Control
Type: CWE
CWE ID: CWE-284
Description: CWE-284 Improper Access Control
Metrics
VersionBase scoreBase severityVector
3.19.6CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Version: 3.1
Base score: 9.6
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

This issue is fixed in AM 6.5.4, 7.1.1, and all later versions.

Configurations
Workarounds

Block access to the following endpoints: /authservice /sessionservice /profileservice /policyservice /namingservice /loggingservice

Exploits
Credits
Escourbiac Maxime and Schmitt Maxence from Mitchelin CERT
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0
N/A
Hyperlink: https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0
Resource: N/A
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0
x_refsource_CONFIRM
x_transferred
Hyperlink: https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0
Resource:
x_refsource_CONFIRM
x_transferred
Details not found