CVE-2017-14394 OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which al...
MediumCVSS 6.1
EPSS 0.79%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| forgerock access management | >= 5.0.0, <= 5.1.1 | No fix listed |
| forgerock openam | >= 13.5.0, <= 13.5.1 | No fix listed |
References
- backstage.forgerock.com vendor-advisory