high7.5Public exploit code
CVE-2021-29156
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OpenAM 13.0 - LDAP Injection2021-11-03 · webapps · java
Impact
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Forgerock | Openam | before 13.5.1 |