CVE-2023-1656: When the LDAP connector is started with StartTLS configured, LDAP BIND cred

When the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.

Status

Published

2023-03-29

Updated

2025-04-14

Assigning organization

ForgeRock

Description

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS)

Default version status: unaffected

1.5.20.9 to ≤ 1.5.20.13affected

References

https://backstage.forgerock.com/knowledge/kb/article/a14149722 ↗
https://backstage.forgerock.com/downloads/browse/idm/all/productId:idm-connectors/subProductId:ldap/minorVersion:1.5/version:1.5.20.14 ↗