ForgeRock OpenAM Deserialization RCE (CVE-2021-29156)
Description
ForgeRock OpenAM allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
Remediation
Upgrade to the latest version of ForgeRock OpenAM