~ / search / GHSA-8hc5-rmgf-qx6p

GHSA-8hc5-rmgf-qx6p

Keycloak vulnerable to LDAP Injection on UsernameForm Login

Source: GitHub Advisory Database (reviewed) Low CVE-2022-2232

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-ldap-federation < 23.0.1 23.0.1
Maven org.keycloak:keycloak-services < 23.0.1 23.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in the Keycloak package. This flaw allows an attacker to benefit from an LDAP query and access existing usernames in the server.

References

External links from the advisory. They lead to third-party sites.