CVE-2023-4727

Ca: token authentication bypass vulnerability

State: Published
Severity: 7.5 High
Published: Jun 11, 2024
Updated: Jun 26, 2026
Reserved: Sep 1, 2023

Description

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-305 Authentication Bypass by Primary Weakness

Affected Products

Product	Versions
keycloak	before 11.5.1Affected
Red Hat Certificate System 10.4 EUS for RHEL-8Red Hat	8060020240529205458.07fb4edf and laterNot affected
Red Hat Enterprise Linux 7Red Hat	0:10.5.18-32.el7_9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	8100020240614102443.82f485b7 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	8040020240329193548.17df0a3f and laterNot affected
Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceRed Hat	8040020240329193548.17df0a3f and laterNot affected
Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsRed Hat	8040020240329193548.17df0a3f and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	8060020240329182634.60523a7b and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat	8060020240329182634.60523a7b and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat	8060020240329182634.60523a7b and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat	8080020240329143735.693a3987 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:11.5.0-2.el9_4 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat	0:11.0.6-3.el9_0 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat	0:11.3.0-2.el9_2 and laterNot affected
Red Hat Enterprise Linux 6Red Hat

References

RHSA-2024:4051vendor-advisory
RHSA-2024:4070vendor-advisory
RHSA-2024:4164vendor-advisory
RHSA-2024:4165vendor-advisory
RHSA-2024:4179vendor-advisory
RHSA-2024:4222vendor-advisory
RHSA-2024:4367vendor-advisory
RHSA-2024:4403vendor-advisory
RHSA-2024:4413vendor-advisory
https://access.redhat.com/security/cve/CVE-2023-4727vdb-entry
RHBZ#2232218issue-tracking
https://github.com/advisories/GHSA-rvm7-rc5g-c98q
https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720
https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.