VulnerabilityModified
CVE-2018-7272
The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.
MEDIUM 6.5EPSS 0.86%
Does this matter?
Lower severity and a low EPSS score (0.86%). Track it; it rarely justifies an emergency change on its own.
Description
The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.
- CVSS 3.0
- 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.86% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- forgerock/access management
- Source
- cve@mitre.org
References
- https://backstage.forgerock.com/knowledge/kb/book/b21824339Vendor Advisory
- https://hansesecure.de/vulnerability-in-am/Third Party Advisory
- https://backstage.forgerock.com/knowledge/kb/book/b21824339Vendor Advisory
- https://hansesecure.de/vulnerability-in-am/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.