CVE-2018-7272 The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.
MediumCVSS 6.5
EPSS 0.86%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| forgerock access management | < 5.5.0 | 5.5.0 |
References
- backstage.forgerock.com vendor-advisory
- hansesecure.de third-party-advisory