High severity · published Mar 29, 2023
CVE-2023-1656
Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
Ldap Connector · Forgerock
1.5.20.9 before 1.5.20.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-1656
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-1656
Permissions Required
https://backstage.forgerock.com/downloads/browse/idm/all/productId:idm-connectors/subProductId:ldap/minorVersion:1.5/version:1.5.20.14
Mitigation
https://backstage.forgerock.com/knowledge/kb/article/a14149722
More from Ldap Connector
9.8
CVE-2022-0143
When the LDAP connector is started with StartTLS configured, unauthenticated access is granted