CVE-2022-0143
CRITICAL
Published Sep 19, 20223y ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Published Sep 19, 2022 3y ago
Last Modified Jun 17, 2026 1w ago
Description
When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to 1.5.20.9. The LDAP connector is bundled with Identity Management (IDM) and Remote Connector Server (RCS)
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-284
CWE-863 Incorrect Authorization Authorization
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| forgerock | ldap_connector | * | <1.5.20.9 |
References 2
- backstage.forgerock.com https://backstage.forgerock.com/downloads/browse/idm/featured/connectors
- backstage.forgerock.com https://backstage.forgerock.com/knowledge/kb/article/a11380515
Remediation
- backstage.forgerock.com https://backstage.forgerock.com/downloads/browse/idm/featured/connectors
- backstage.forgerock.com https://backstage.forgerock.com/knowledge/kb/article/a11380515