PT-2019-7970 · Forgerock · Access Management+1

Publicado 2019-06-19 · Atualizado 2019-06-21 · CVE-2017-14395

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ForgeRock Access Management (OpenAM) versions 13.5.0 through 13.5.1 Access Management (AM) versions 5.0.0 through 5.1.1

Description The issue arises from incorrect validation of the redirect uri for some invalid requests, allowing attackers to execute a script in the user's browser via reflected XSS.

Recommendations For ForgeRock Access Management (OpenAM) versions 13.5.0 through 13.5.1, update to a version that correctly validates redirect uri to prevent reflected XSS attacks. For Access Management (AM) versions 5.0.0 through 5.1.1, update to a version that correctly validates redirect uri to prevent reflected XSS attacks. As a temporary workaround, consider restricting access to the Auth 2.0 Authorization Server to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-14395

Produtos afetados

Access Management

Forgerock Access Management

Referências · 4

• https://t.me/cibsecurity/5032 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-14395 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14395 · Nota de Segurança
• https://backstage.forgerock.com/knowledge/kb/article/a45958025 · Aviso do Fabricante