GitHub Advisoryadvisory · Maven
GHSA-8hc5-rmgf-qx6p Keycloak vulnerable to LDAP Injection on UsernameForm Login
LOW
Official page ↗
- Aliases
- CVE-2022-2232
- Ecosystem
- Maven
- Packages
- org.keycloak:keycloak-ldap-federation, org.keycloak:keycloak-services
- Severity
- Low
- Weaknesses
- CWE-90
- Reviewed
- 2023-11-29
Affected packages
• Maven org.keycloak:keycloak-ldap-federation: < 23.0.1 → fixed in 23.0.1
• Maven org.keycloak:keycloak-services: < 23.0.1 → fixed in 23.0.1
Description
A flaw was found in the Keycloak package. This flaw allows an attacker to benefit from an LDAP query and access existing usernames in the server.
Related
Alias · CVE (1)
- CVE-2022-2232 A flaw was found in the Keycloak package. vulnerability
Weakness · CWE (1)
- CWE-90 Improper Neutralization of Special Elements used in an LDAP Query weakness