Security readout for executives and security teams
Plain-English summary
CVE-2017-14395 is a reflected cross-site scripting issue in the OAuth 2.0 Authorization Server component of ForgeRock OpenAM and Access Management. A vulnerable login or authorization flow could cause script to run in a user's browser. The source bundle does not provide CVSS, patch details, or evidence of active exploitation.
Executive priority
Treat this as a targeted identity-platform risk, not a general internet emergency. Prioritize if affected ForgeRock OAuth services are externally reachable or protect sensitive applications. Lack of CVSS and exploitation evidence lowers urgency, but identity XSS can still create business impact.
Technical view
ForgeRock OpenAM 13.5.0-13.5.1 and Access Management 5.0.0-5.1.1 incorrectly validate redirect_uri for some invalid OAuth requests. The reported impact is reflected XSS in the user's browser. Available data does not include CWE mapping, CVSS vector, fixed versions, or detailed vendor mitigation text.
Likely exposure
Exposure is most likely where affected ForgeRock OpenAM or Access Management versions provide OAuth 2.0 authorization services, especially internet-facing identity portals. The bundle's affected metadata is sparse, so confirm against local product inventories and the vendor advisory.
Exploitation context
The source bundle marks this CVE as not in CISA KEV and provides no cited evidence of active exploitation. Exploitation would require a user browser interaction with a crafted authorization flow, but the bundle does not provide enough detail to assess exploit reliability.
Researcher notes
The public bundle is limited: no CVSS, CWE, fixed-version detail, or advisory content beyond the ForgeRock reference URL. Analysis should stay bounded to the described reflected XSS in redirect_uri validation for the listed ForgeRock versions.
Mitigation direction
- Check the ForgeRock advisory for fixed versions or supported configuration mitigations.
- Prioritize vendor-supported remediation for OpenAM 13.5.0-13.5.1 and AM 5.0.0-5.1.1.
- Review OAuth client redirect URI allowlists for unnecessary or unsafe entries.
- Apply compensating web controls only as temporary risk reduction.
Validation and detection
- Inventory ForgeRock OpenAM and Access Management versions in production and staging.
- Identify systems running OAuth 2.0 Authorization Server functionality.
- Review authorization request logs for anomalous redirect_uri validation failures.
- Confirm remediation status against the ForgeRock advisory and change records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14395 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://backstage.forgerock.com/knowledge/kb/article/a45958025CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.