Loading
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
Use CWE-74, Forgerock vendor hub and Openam product page to widen CVE-2021-29156 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2021-35464, CVE-2016-10097 and CVE-2017-14395 for nearby disclosures in the same product family.