CVE-2018-7272

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Feb 21, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-72735.5In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls withCVE-2018-72746.1Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title), WCVE-2018-72767.5An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitiCVE-2018-72776.1An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavCVE-2018-72786.1An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers CVE-2018-72799.8A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1.CVE-2018-72806.1The Ninja Forms plugin before 3.2.14 for WordPress has XSS.CVE-2018-72818.8CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. The binary takes a sCVE-2018-72829.8The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.CVE-2018-72847.5A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk thrCVE-2018-72857.5A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamiCVE-2018-72866.5An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert