CVE-2022-24669: Anonymous users can register / de-register for configuration change notifications
It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2022-24669?
CVE-2022-24669 is a vulnerability that may allow an attacker to gain details of the deployment and probe internal network services in ForgeRock Access Management.
How severe is CVE-2022-24669?
CVE-2022-24669 has a severity level of 6.5 (medium).
Which software versions are affected by CVE-2022-24669?
ForgeRock Access Management versions 6.0.0 to 6.0.0.7, 6.5.0 to 6.5.0.2, 6.5.2.1 to 6.5.2.3, 6.5.1, 6.5.3, 6.5.4, 7.0.0 to 7.0.2, and 7.1.0 are affected by CVE-2022-24669.
How can an attacker exploit CVE-2022-24669?
An attacker can exploit CVE-2022-24669 through a well-crafted attack to gain details of the deployment and probe internal network services.
How can I mitigate CVE-2022-24669?
To mitigate CVE-2022-24669, it is recommended to apply the necessary security patches provided by ForgeRock and regularly update the Access Management software.