CVE-2021-35464 - CVE House
Back to Database
Status published Unknown CVE-2021-35464

ForgeRock AM server before 7.0 has a Java deserialization vulnerability...

Vulnerability Description

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-35464

Credits & Attribution

No credits recorded in the NVD database.

References

More from forgerock

View All →
CVE-2023-0582
Path Traversal in ForgeRock Access Managment
High 8.1
CVE-2021-37154
In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation...
Critical 9.8
CVE-2021-37153
ForgeRock Access Management (AM) before 7.0.2, when configured with Active...
Critical 9.8
CVE-2021-29156
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger...
High 7.5
CVE-2020-17465
Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are...
Medium 6.1

Affected Vendor

Affected Software

access management, openam
Vulnerable Versions:
0, 9.0.0

Timeline

Official Publish: July 22nd, 2021
Last Modified: October 21st, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.