CVE-2021-35464
Quick assessment
Affected
n/a n/a
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ForgeRock AM是一个开源的访问管理、权限控制平台，在大学、社会组织中存在广泛的应用。 ForgeRock AM存在代码问题漏洞，未经身份验证的攻击者可以通过构造特殊的请求远程执行任意代码，并接管运行ForgeRockAM的服务器。
Public Exploits 3
ExploitDB · 1
EDB-50131 [webapps]
Metasploit · 1
cve_2021_35464_forgerock_openam.rb [exploit]
Nuclei · 1
CVE-2021-35464.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 3 AI
T1203 · Exploitation for Client Execution T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-35464
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
ForgeRock AM 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ForgeRock AM是一个开源的访问管理、权限控制平台，在大学、社会组织中存在广泛的应用。 ForgeRock AM存在代码问题漏洞，未经身份验证的攻击者可以通过构造特殊的请求远程执行任意代码，并接管运行ForgeRockAM的服务器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2021-35464
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | openam-CVE-2021-35464 tomcat 执行命令回显 | https://github.com/Y4er/openam-CVE-2021-35464 | POC Details |
| 2 | None | https://github.com/rood8008/CVE-2021-35464 | POC Details |
| 3 | ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-35464.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-35464
请登录查看更多情报信息。
Other References for CVE-2021-35464 (2)
-
https://bugster.forgerock.org x_refsource_MISC
-
https://backstage.forgerock.com/knowledge/kb/article/a47894244 x_refsource_CONFIRM
Same Patch Batch · n/a · 2021-07-22 · 58 CVEs total
| CVE-2021-36222 | MIT Kerberos 代码问题漏洞 | |
| CVE-2020-22284 | lwip 安全漏洞 | |
| CVE-2021-34261 | STMicroelectronics STM32Cube 安全漏洞 | |
| CVE-2021-34260 | STMicroelectronics STM32Cube 缓冲区错误漏洞 | |
| CVE-2021-34259 | STMicroelectronics STM32Cube Middleware 安全漏洞 | |
| CVE-2021-34262 | STMicroelectronics STM32Cube 缓冲区错误漏洞 | |
| CVE-2021-26224 | SourceCodester Fantastic-Blog-CMS 跨站脚本漏洞 | |
| CVE-2021-26223 | CASAP Automated Enrollment SQL注入漏洞 | |
| CVE-2021-33032 | EQ-3 eQ-3 HomeMatic CCU2 和 CCU3 操作系统命令注入漏洞 | |
| CVE-2020-36033 | Sourcecodester SourceCodester Water Billing System SQL注入漏洞 | |
| CVE-2021-27332 | CASAP Automated Enrollment 跨站脚本漏洞 | |
| CVE-2021-25197 | SourceCodester Content Management System 跨站脚本漏洞 | |
| CVE-2015-2098 | WebGate eDVR Manager 缓冲区溢出漏洞 | |
| CVE-2015-2099 | webgateinc WebGate Control Center 缓冲区溢出漏洞 | |
| CVE-2021-25202 | Bakeshop Inventory System SQL注入漏洞 | |
| CVE-2015-2100 | webgateinc WebGate Control Center 缓冲区错误漏洞 | |
| CVE-2021-26226 | CASAP Automated Enrollment SQL注入漏洞 | |
| CVE-2021-35063 | Suricata 安全漏洞 | |
| CVE-2021-33478 | Broadcom Media exChange 缓冲区错误漏洞 | |
| CVE-2021-26227 | CASAP Automated Enrollment 跨站脚本漏洞 |
Showing top 20 of 58 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2021-35464
No comments yet