Описание
A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.
Меры по смягчению последствий
This flaw requires a misconfiguration of the "UUID LDAP Attribute" values. When they are set to the standard entryUUID, objectGUID or nsuniqueid Keycloak is not vulnerable.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Single Sign-On 7 | rh-sso7-keycloak | Affected |
Показывать по
10
Дополнительная информация
Статус:
Low
Дефект:
CWE-20
https://bugzilla.redhat.com/show_bug.cgi?id=2096994keycloak: LDAP injection on username input
EPSS
Процентиль: 49%
0.00651
Низкий
7.5 High
CVSS3
Связанные уязвимости
CVSS3: 7.5
nvd
почти 2 года назад
A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.
CVSS3: 7.5
debian
почти 2 года назад
A flaw was found in the Keycloak package. This flaw allows an attacker ...
github
почти 3 года назад
Keycloak vulnerable to LDAP Injection on UsernameForm Login
EPSS
Процентиль: 49%
0.00651
Низкий
7.5 High
CVSS3