Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2021-4201

Pre-authentication session hijacking

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ForgeRock

Description

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ForgeRock Access Management

  • 7.1 to < 7.1.1affected
  • 6.5 to < 6.5.4affected

References