Lucene search

GitHub Advisory DatabaseGHSA-8HC5-RMGF-QX6P

HistoryNov 29, 2023 - 9:33 p.m.

Keycloak vulnerable to LDAP Injection on UsernameForm Login

2023-11-2921:33:07

CWE-90

GitHub Advisory Database

github.com

keycloak

ldap injection

usernameform

security flaw

usernames

6.9 Medium

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

A flaw was found in the Keycloak package. This flaw allows an attacker to benefit from an LDAP query and access existing usernames in the server.

Affected configurations

Vulners

Node

org.keycloak\keycloakMatchservices

org.keycloak\keycloakMatchcore

CPENameOperatorVersion
org.keycloak:keycloak-serviceslt23.0.1
org.keycloak:keycloak-ldap-federationlt23.0.1

CPE	Name	Operator	Version
	org.keycloak:keycloak-services	lt	23.0.1
	org.keycloak:keycloak-ldap-federation	lt	23.0.1

github.com/advisories/GHSA-8hc5-rmgf-qx6p

github.com/keycloak/keycloak/commit/4252e394cf725b16f7e4e19aa32b03fd3fe13fde

github.com/keycloak/keycloak/security/advisories/GHSA-8hc5-rmgf-qx6p