It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services.

An attacker can use the unrestricted LDAP queries to determine configuration entries

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.