CVE-2021-4201 Pre-authentication session hijacking

What is CVE-2021-4201?

CVE-2021-4201 is a critical missing authorization vulnerability in ForgeRock Access Management, published on 14 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.

Weakness: CWE-287, CWE-284

Which versions are affected by CVE-2021-4201?

It affects 1 product.

Products include Forgerock Access Management.

How do I fix CVE-2021-4201?

No fix has been published for CVE-2021-4201 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-4201 being exploited?

There is no known exploitation of CVE-2021-4201 in the wild and no public exploit code.

Other vulnerabilities in ForgeRock Access Management

• CVE-2021-35464 ForgeRock Access Management (AM) Core Server Remote Code Execution Exploited Critical 9.8
• CVE-2022-3748 Improper authorization that can lead to account impersonation Critical 9.8
• CVE-2021-37153 Auth bypass in n/a Critical 9.8
• CVE-2021-37154 XML external entity in n/a Critical 9.8
• CVE-2023-0582 Path Traversal in ForgeRock Access Managment High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-63v3-hpf5-wfmw.