ForgeRock vulnerabilities
We track 7 vulnerabilities in ForgeRock products across 8 products. 7 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on March 27, 2024.
Latest ForgeRock vulnerabilities
- 9.8 Critical severity
access management: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.
- 9.8 Critical severity
Access Management: Improper Authorization
Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0.
- 7.5 High severity
OpenIDM and Java Remote Connector Server (RCS): Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Con
- 9.8 Critical severity
Access Management Java Policy Agent: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Access Management Java Policy Agent: all versions up to 5.10.1
- 9.8 Critical severity
Access Management Web Policy Agent: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Policy Agent: all versions up to 5.10.1
- 9.8 Critical severity
LDAP Connector: Incorrect Authorization
When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to 1.5.20.9. The LDAP connector is bundled with Identity Management (IDM) and Remote Connector Server (
- 9.8 Critical severity
ForgeRock Access Management (AM) Core Server Remote Code Execution Exploited
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* r