VULNERABILITY INTELLIGENCE

CVE-2016-6500

CVSS score8.1 HIGH
EPSS probability2.28%
CISA KEVNot currently listed
Published2017-02-03
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnObjFlag set to true, which allows remote attackers to execute arbitrary code via a crafted serialized Java object, aka LDAP entry poisoning.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references