CVE-2023-1656CWE-319

When the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.

High · published March 29, 2023

CVSS v3.1
7.5
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.1th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2023-03-29T19:55Z
EPSS history
Timeline
  • 29 MAR 19:55Z
    When the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.
    cvelistv5