PT-2019-7970 · Forgerock · Access Management+1

Published 2019-06-19 · Updated 2019-06-21 · CVE-2017-14395

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ForgeRock Access Management (OpenAM) versions 13.5.0 through 13.5.1 Access Management (AM) versions 5.0.0 through 5.1.1

Description The issue arises from incorrect validation of the redirect uri for some invalid requests, allowing attackers to execute a script in the user's browser via reflected XSS.

Recommendations For ForgeRock Access Management (OpenAM) versions 13.5.0 through 13.5.1, update to a version that correctly validates redirect uri to prevent reflected XSS attacks. For Access Management (AM) versions 5.0.0 through 5.1.1, update to a version that correctly validates redirect uri to prevent reflected XSS attacks. As a temporary workaround, consider restricting access to the Auth 2.0 Authorization Server to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-14395

Affected Products

Access Management

Forgerock Access Management

References · 4

• https://osv.dev/vulnerability/CVE-2017-14395 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14395 · Security Note
• https://backstage.forgerock.com/knowledge/kb/article/a45958025 · Vendor Advisory
• https://t.me/cibsecurity/5032 · Telegram Post