CVE-2021-37154 XML external entity in n/a
Attackers can inject XML into SAML2 assertions to bypass authentication or take over accounts in ForgeRock Access Management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37154?
CVE-2021-37154 is a critical vulnerability in n/a, published on 25 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.
Weakness: CWE-91
Which versions are affected by CVE-2021-37154?
It affects 1 product.
Products include Forgerock Access Management.
How do I fix CVE-2021-37154?
No fix has been published for CVE-2021-37154 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-37154 being exploited?
There is no known exploitation of CVE-2021-37154 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-35464 ForgeRock Access Management (AM) Core Server Remote Code Execution
- CVE-2022-3748 Improper authorization that can lead to account impersonation
- CVE-2021-37153 Auth bypass in n/a
- CVE-2021-4201 Pre-authentication session hijacking
- CVE-2023-0582 Path Traversal in ForgeRock Access Managment
Sources
Also known as GHSA-xqvg-mhw9-7644.