CVE-2018-7272

Опубликовано: 21 фев. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.

Ссылки

https://backstage.forgerock.com/knowledge/kb/book/b21824339
Vendor Advisory
https://hansesecure.de/vulnerability-in-am/
Third Party Advisory
https://backstage.forgerock.com/knowledge/kb/book/b21824339
Vendor Advisory
https://hansesecure.de/vulnerability-in-am/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*

Версия до 5.5.0 (исключая)

EPSS

Процентиль: 52%

0.00294

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-9xmg-qx66-c5gw