PingIDM Access Control Vulnerability for Remote Connector Servers in Client Mode

A vulnerability exists in PingIDM (formerly ForgeRock Identity Management) due to insufficient access control granularity. Administrators are unable to properly configure access rules for Remote Connector Servers (RCS) operating in client mode. This flaw allows attackers to spoof a client-mode RCS, if one is available, and intercept or modify sensitive identity properties, such as passwords and account recovery details. The vulnerability is exploitable only when an RCS is set to run in client mode.

Impact

Exploitation of this vulnerability could lead to unauthorized interception or modification of an identity's security-sensitive information, including passwords and account recovery data.