VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jun 19, 2019· Updated Jun 17, 2026

CVE-2017-14394

CVE-2017-14394

Description

OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.

Affected products

5
  • Forgerock/Access Management2 versions
    cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:forgerock:access_management:*:*:*:*:*:*:*:*range: >=5.0.0,<=5.1.1
    • (no CPE)range: 13.5.0-13.5.1
  • Forgerock/Openam2 versions
    cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*range: >=13.5.0,<=13.5.1
    • (no CPE)range: 13.5.0-13.5.1
  • ForgeRock/Access Managementdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.