Detections
Analytics
OpenAM RCE (CVE-2021-35464)
critical Nessus Plugin ID 152139
Language:
Synopsis
Open Access Management (OpenAM) is affected by a remote code execution vulnerability.Description
The version of Open Access Management (OpenAM) detected on the remote host is affected by a remote code execution vulnerability due to unsafe object deserialization. An unauthenticated, remote attacker can exploit this to execute code on the remote host.Solution
Upgrade to the relevant fixed version referenced in the vendor advisory.See Also
http://www.nessus.org/u?c3a6dd6c
http://www.nessus.org/u?9b6c0973
https://backstage.forgerock.com/knowledge/kb/article/a47894244
Plugin Details
Severity: Critical
ID: 152139
File Name: openam_cve-2021-35464.nbin
Version: 1.53
Type: remote
Family: CGI abuses
Published: 7/29/2021
Updated: 4/23/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.2
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2021-35464
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:forgerock:openam
Required KB Items: installed_sw/OpenAM
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/29/2021
Vulnerability Publication Date: 6/29/2021
CISA Known Exploited Vulnerability Due Dates: 11/17/2021
Exploitable With
Metasploit (ForgeRock / OpenAM Jato Java Deserialization)
Reference Information
CVE: CVE-2021-35464
IAVA: 2021-A-0359-S