CVE-2017-14394

OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cve@mitre.org

Published

2019-06-19

Last modified

2024-08-05

Weaknesses

CWE-601

Affected products

• Access Management (Forgerock)
• Openam (Forgerock)

References

• https://backstage.forgerock.com/knowledge/kb/article/a45958025