CVE-2021-37153 Auth bypass in n/a
Attackers can bypass authentication in ForgeRock Access Management when configured with Active Directory as the Identity Store.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37153?
CVE-2021-37153 is a critical authentication bypass vulnerability in n/a, published on 25 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue.
Which versions are affected by CVE-2021-37153?
It affects 1 product.
Products include Forgerock Access Management.
How do I fix CVE-2021-37153?
No fix has been published for CVE-2021-37153 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-37153 being exploited?
There is no known exploitation of CVE-2021-37153 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-35464 ForgeRock Access Management (AM) Core Server Remote Code Execution
- CVE-2022-3748 Improper authorization that can lead to account impersonation
- CVE-2021-37154 XML external entity in n/a
- CVE-2021-4201 Pre-authentication session hijacking
- CVE-2023-0582 Path Traversal in ForgeRock Access Managment
Sources
Also known as GHSA-fcqv-pq7x-c62w.