CVE-2021-35464

Summary

CVE-2021-35464 is a Java deserialization vulnerability affecting ForgeRock Access Management (AM) servers before version 7.0. This issue is located in the jato.pageSession parameter on various pages. An attacker can exploit this vulnerability without authentication by sending a crafted /ccversion/\* request, leading to remote code execution. The root cause is the utilization of Sun ONE Application Framework (JATO), which is found in Java 8 and earlier versions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.