Vulnerability · Published Feb 14, 2022 · Assigned by ForgeRock
CVE-2021-4201Pre-authentication session hijacking
Critical 9.6
In plain English
A critical-severity improper access control in Access Management from ForgeRock. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)2.0%top 19.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ForgeRock | Access Management | 7.1 – before 7.1.16.5 – before 6.5.4 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H