CVE-2023-4727

Description

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

References

• Advisories
• More

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS