published March 25, 2021
NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.