{"id":"CVE-2023-4727","state":"PUBLISHED","title":"Ca: token authentication bypass vulnerability","description":"A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.","publishedAt":"2024-06-11T19:30:25.613Z","updatedAt":"2026-06-26T09:19:30.855Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["keycloak","Red Hat Red Hat Certificate System 10.4 EUS for RHEL-8","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service","Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support","Red Hat Red Hat Enterprise Linux 6"],"affected":[{"packageName":"keycloak","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"11.5.1","versionType":"semver"}],"collectionURL":"https://www.keycloak.org/"},{"vendor":"Red Hat","product":"Red Hat Certificate System 10.4 EUS for RHEL-8","packageName":"redhat-pki:10","defaultStatus":"affected","versions":[{"version":"8060020240529205458.07fb4edf","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system_eus:10.4::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"pki-core","defaultStatus":"affected","versions":[{"version":"0:10.5.18-32.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::client","cpe:/o:redhat:enterprise_linux:7::computenode","cpe:/o:redhat:enterprise_linux:7::server","cpe:/o:redhat:enterprise_linux:7::workstation"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8100020240614102443.82f485b7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8040020240329193548.17df0a3f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Telecommunications Update Service","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8040020240329193548.17df0a3f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8040020240329193548.17df0a3f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8060020240329182634.60523a7b","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8060020240329182634.60523a7b","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8060020240329182634.60523a7b","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8080020240329143735.693a3987","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pki-core","defaultStatus":"affected","versions":[{"version":"0:11.5.0-2.el9_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"pki-core","defaultStatus":"affected","versions":[{"version":"0:11.0.6-3.el9_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"pki-core","defaultStatus":"affected","versions":[{"version":"0:11.3.0-2.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"pki-core","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]}],"references":["https://access.redhat.com/errata/RHSA-2024:4051","https://access.redhat.com/errata/RHSA-2024:4070","https://access.redhat.com/errata/RHSA-2024:4164","https://access.redhat.com/errata/RHSA-2024:4165","https://access.redhat.com/errata/RHSA-2024:4179","https://access.redhat.com/errata/RHSA-2024:4222","https://access.redhat.com/errata/RHSA-2024:4367","https://access.redhat.com/errata/RHSA-2024:4403","https://access.redhat.com/errata/RHSA-2024:4413","https://access.redhat.com/security/cve/CVE-2023-4727","https://bugzilla.redhat.com/show_bug.cgi?id=2232218","https://github.com/advisories/GHSA-rvm7-rc5g-c98q","https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720","https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388"],"weaknesses":["CWE-305"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4727.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-4727","state":"PUBLISHED","datePublished":"2024-06-11T19:30:25.613Z","dateUpdated":"2026-06-26T09:19:30.855Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-09-01T20:44:55.077Z"},"containers":{"cna":{"title":"Ca: token authentication bypass vulnerability","descriptions":[{"lang":"en","value":"A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege."}],"affected":[{"packageName":"keycloak","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"11.5.1","versionType":"semver"}],"collectionURL":"https://www.keycloak.org/"},{"vendor":"Red Hat","product":"Red Hat Certificate System 10.4 EUS for RHEL-8","packageName":"redhat-pki:10","defaultStatus":"affected","versions":[{"version":"8060020240529205458.07fb4edf","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certificate_system_eus:10.4::el8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"pki-core","defaultStatus":"affected","versions":[{"version":"0:10.5.18-32.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7::client","cpe:/o:redhat:enterprise_linux:7::computenode","cpe:/o:redhat:enterprise_linux:7::server","cpe:/o:redhat:enterprise_linux:7::workstation"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8100020240614102443.82f485b7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8040020240329193548.17df0a3f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Telecommunications Update Service","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8040020240329193548.17df0a3f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8040020240329193548.17df0a3f","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_e4s:8.4::appstream","cpe:/a:redhat:rhel_tus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8060020240329182634.60523a7b","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8060020240329182634.60523a7b","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8060020240329182634.60523a7b","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_e4s:8.6::appstream","cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","packageName":"pki-core:10.6","defaultStatus":"affected","versions":[{"version":"8080020240329143735.693a3987","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pki-core","defaultStatus":"affected","versions":[{"version":"0:11.5.0-2.el9_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"pki-core","defaultStatus":"affected","versions":[{"version":"0:11.0.6-3.el9_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","packageName":"pki-core","defaultStatus":"affected","versions":[{"version":"0:11.3.0-2.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.2::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"pki-core","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:4051","name":"RHSA-2024:4051","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4070","name":"RHSA-2024:4070","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4164","name":"RHSA-2024:4164","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4165","name":"RHSA-2024:4165","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4179","name":"RHSA-2024:4179","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4222","name":"RHSA-2024:4222","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4367","name":"RHSA-2024:4367","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4403","name":"RHSA-2024:4403","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4413","name":"RHSA-2024:4413","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4727","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232218","name":"RHBZ#2232218","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/advisories/GHSA-rvm7-rc5g-c98q"},{"url":"https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720"},{"url":"https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-305","description":"Authentication Bypass by Primary Weakness","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-26T09:19:30.855Z"},"datePublic":"2024-06-11T00:00:00.000Z","x_redhatCweChain":"CWE-305: Authentication Bypass by Primary Weakness","timeline":[{"lang":"en","time":"2023-08-15T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-06-11T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Pham Van Khanh (Calif) for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-11T20:43:47.420318Z","id":"CVE-2023-4727","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-12T12:00:14.636Z"}},{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:4051","name":"RHSA-2024:4051","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4070","name":"RHSA-2024:4070","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4164","name":"RHSA-2024:4164","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4165","name":"RHSA-2024:4165","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4179","name":"RHSA-2024:4179","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4222","name":"RHSA-2024:4222","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4367","name":"RHSA-2024:4367","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4403","name":"RHSA-2024:4403","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4413","name":"RHSA-2024:4413","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4727","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232218","name":"RHBZ#2232218","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:38:00.502Z"}}]}}}