CVE-2023-1656

When the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.

State: Published
Severity: 7.5 High
Published: Mar 29, 2023
Updated: Apr 14, 2025
Reserved: Mar 27, 2023

Read the record on cve.org

Description

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	ForgeRock

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

Product	Versions
OpenIDM and Java Remote Connector Server (RCS)ForgeRock Inc.	1.5.20.9 through 1.5.20.13Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.