Vulnerability · Published Mar 29, 2023 · Assigned by ForgeRock
CVE-2023-1656When the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.
High 7.5
In plain English
A high-severity security flaw in OpenIDM and Java Remote Connector Server (RCS) from ForgeRock Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 71.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ForgeRock Inc. | OpenIDM and Java Remote Connector Server (RCS) | 1.5.20.9 – through 1.5.20.13 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H