Ldap Injection Vulnerability in dogtag-pki and pki-core Could Lead to Privilege Escalation

CVE-2023-4727

Summary

A vulnerability exists within Red Hat's Dogtag PKI and pki-core products, where an attacker can exploit a flaw in the token authentication mechanism through an LDAP injection. By manipulating the query string parameter 'sessionID=*', the attacker may authenticate using an existing session stored in the LDAP directory server. This could potentially allow unauthorized access and lead to an escalation of privileges, compromising the integrity of the system and sensitive information.

References