High · 7.5 CVE-2023-1656 EUVD-2023-23885GHSA-3452-rvwh-rv7h

When the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.

Published Mar 29, 2023 · Updated Apr 14, 2025 · Assigned by ForgeRock

Vendor: ForgeRock Product: OpenIDM and Java Remote Connector Server (RCS)

Description

Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.

Affected products

Vendor	Product	Affected	Fixed
ForgeRock	OpenIDM and Java Remote Connector Server (RCS)	1.5.20.9 – ≤ 1.5.20.13	—

References

https://backstage.forgerock.com/knowledge/kb/article/a14149722 vendor-advisory
https://backstage.forgerock.com/downloads/browse/idm/all/productId:idm-connectors/subProductId:ldap/minorVersion:1.5/version:1.5.20.14 product