CVE-2022-0143

When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to 1.5.20.9. The LDAP connector is bundled with Identity Management (IDM) and Remote Connector Server (RCS)
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
ForgeRockCNA
9.3 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
VendorProductVersion
forgerockldap_connector
𝑥
< 1.5.20.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://backstage.forgerock.com/downloads/browse/idm/featured/connectors
https://backstage.forgerock.com/knowledge/kb/article/a11380515
https://backstage.forgerock.com/downloads/browse/idm/featured/connectors
https://backstage.forgerock.com/knowledge/kb/article/a11380515