CVE-2021-29156
CVE-2021-29156
Vexday Risk Score
60Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Popular PoC on GitHub (4 stars) — exploitation code widely available.
CVSS —EPSS 76.4%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
25 Mar 2021Published on NVD
03 Nov 2021Public PoC
Weaponization speed
223 daysto first PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
Affected products
n/a · n/apublic PoCs found — 3
githubgithub.com/guidepointsecurity/CVE-2021-29156★ 4githubgithub.com/5amu/CVE-2021-29156★ 1exploitdbwww.exploit-db.com/exploits/50480unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.