CVE-2022-3748

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
ForgeRock Inc.	Access Management	>= 6.5.0, <= 7.2.0

References

https://backstage.forgerock.com/downloads/browse/am/all/productId:amPermissions Required
https://backstage.forgerock.com/knowledge/kb/article/a34332318Vendor Advisory
https://backstage.forgerock.com/knowledge/kb/article/a92134872Vendor Advisory
https://backstage.forgerock.com/downloads/browse/am/all/productId:amPermissions Required
https://backstage.forgerock.com/knowledge/kb/article/a34332318Vendor Advisory
https://backstage.forgerock.com/knowledge/kb/article/a92134872Vendor Advisory

Timeline

Published: Apr 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-37504.7The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-37519.8SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.CVE-2022-37527.5An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-CVE-2022-37534.8The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as CVE-2022-37549.8Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-37585.4An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.CVE-2022-37597.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before CVE-2022-375989.8Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor CVE-2022-375997.5A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.CVE-2022-37609.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mia Technology Mia-Med. This issue af CVE-2022-376019.8Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. Th CVE-2022-376029.8Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.