VulnerabilityModified

CVE-2023-1656

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc.

HIGH 7.5EPSS 0.35%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.35% probability · 28th percentile
CISA KEV: Not listed
Weakness: CWE-319
Affected: forgerock/ldap connector
Source: psirt@forgerock.com

References

https://backstage.forgerock.com/downloads/browse/idm/all/productId:idm-connectors/subProductId:ldap/minorVersion:1.5/version:1.5.20.14Permissions Required
https://backstage.forgerock.com/knowledge/kb/article/a14149722Mitigation, Vendor Advisory
https://backstage.forgerock.com/downloads/browse/idm/all/productId:idm-connectors/subProductId:ldap/minorVersion:1.5/version:1.5.20.14Permissions Required
https://backstage.forgerock.com/knowledge/kb/article/a14149722Mitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.