CVE-2017-14394
MEDIUMForgeRock Access Management 5.0.0-5.1.1 and OpenAM 13.5.0-13.5.1 - Open Redirect via OAuth 2.0 Authorization Server
Title source: llmDescription
OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_misc
https://backstage.forgerock.com/knowledge/kb/article/a45958025
Scores
CVSS v3
6.1
EPSS
0.0079
EPSS Percentile
51.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-601
Status
published
Products (2)
forgerock/access_management
5.0.0 - 5.1.1
forgerock/openam
13.5.0 - 13.5.1
Published
Jun 19, 2019
Tracked Since
Feb 18, 2026