CVE-2018-7272 Information disclosure in n/a

What is CVE-2018-7272?

CVE-2018-7272 is a medium-severity vulnerability in n/a, published on 21 Feb 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.

Weakness: CWE-200

Which versions are affected by CVE-2018-7272?

It affects 1 product.

Products include Forgerock Access Management.

How do I fix CVE-2018-7272?

No fix has been published for CVE-2018-7272 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-7272 being exploited?

There is no known exploitation of CVE-2018-7272 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-35464 ForgeRock Access Management (AM) Core Server Remote Code Execution Exploited Critical 9.8
• CVE-2022-3748 Improper authorization that can lead to account impersonation Critical 9.8
• CVE-2021-37153 Auth bypass in n/a Critical 9.8
• CVE-2021-37154 XML external entity in n/a Critical 9.8
• CVE-2021-4201 Pre-authentication session hijacking Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9xmg-qx66-c5gw.