CVE-2016-6500

high ForgeRock
CVSS v3 Base Score
8.1
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.9%
Exploitation probability in 30 days
Top 17% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Confidentiality
High
Integrity
High
Availability
High
Published: February 3, 2017 (3387 days ago)
Last Modified: May 13, 2026
Vendor: ForgeRock
Source: NVD

Description

Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnObjFlag set to true, which allows remote attackers to execute arbitrary code via a crafted serialized Java object, aka LDAP entry poisoning.

CWE

CWE-20

Affected Products

forgerock racf connector

References

🔗 backstage.forgerock.com 🔗 backstage.forgerock.com