Detections
Analytics
CVE-2023-4727
high
Description
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.
References
https://bugzilla.redhat.com/show_bug.cgi?id=2232218
https://access.redhat.com/security/cve/CVE-2023-4727
https://access.redhat.com/errata/RHSA-2024:4222
https://access.redhat.com/errata/RHSA-2024:4179
https://access.redhat.com/errata/RHSA-2024:4165
https://access.redhat.com/errata/RHSA-2024:4164