Keycloak Package Vulnerability: LDAP Injection Flaw Discovered
CVE-2022-2232
7.5HIGH
Summary
A vulnerability exists within the Keycloak package that enables an attacker to exploit LDAP injection techniques. This flaw permits the circumvention of username lookups, potentially allowing the execution of unauthorized queries or actions in the system. If an attacker is able to leverage this vulnerability, it could lead to unauthorized access and compromise of sensitive information. System administrators are encouraged to review the impacted versions and implement recommended updates to mitigate the risk.
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Konstantin Goldenberg (VHV) for reporting this issue.