CVE-2023-4727 — Ca: token authentication bypass vulnerability
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacke…
Published: 2024-06-11 · CVSS: 7.5 · CVSS 3.1
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7