CVE-2021-4201 - Pre-authentication session hijacking

Back Back to CVE browser

CRITICAL

Pre-authentication session hijacking

Published Feb 14, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.99%

Description

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.

Affected products

Vendor ForgeRock Product Access Management Default
n/a
- Version
  6.5
  Status
  affected
  Constraints
  <6.5.4
- Version
  7.1
  Status
  affected
  Constraints
  <7.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ForgeRock

Access Management

n/a

Version	Status	Constraints
6.5	affected	<6.5.4
7.1	affected	<7.1.1

Remediation

Vendor solution

This issue is fixed in AM 6.5.4, 7.1.1, and all later versions.

Weaknesses (2)

CWE-284

CWE-287

Improper Authentication

References (2)

https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0
PatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34059
Advisory

Link	Providers	Tags
https://backstage.forgerock.com/knowledge/kb/article/a50037155#x7ZPA0		PatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34059		Advisory