PT-2021-21536 · Forgerock · Forgerock Access Management

Published 2021-08-25 · Updated 2021-09-01 · CVE-2021-37154

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ForgeRock Access Management (AM) versions prior to 7.0.2

Description The SAML2 implementation in the affected software allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.

Recommendations For versions prior to 7.0.2, update to version 7.0.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2021-37154

Affected Products

Forgerock Access Management

References · 4

• https://forgerock.com/platform/access-management · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37154 · Security Note
• https://backstage.forgerock.com/knowledge/kb/article/a55763454 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37154 · Vendor Advisory