Ca: token authentication bypass vulnerability
Priority LOW 36CWE-305Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 18 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00665 52nd percentileScored 2026-11-07
Fix Partial keycloak: 11.5.1Red Hat: 9 advisoriesRed Hat: 18 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | keycloak | before 11.5.1 | 11.5.1 | Patch available | CNA |
| Red Hat | Red Hat Certificate System 10.4 EUS for RHEL-8 | — | 8060020240529205458.07fb4edf | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | 10.5.18-32.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 8100020240614102443.82f485b7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 8040020240329193548.17df0a3f | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | 8040020240329193548.17df0a3f | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | 8040020240329193548.17df0a3f | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 8060020240329182634.60523a7b | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 8060020240329182634.60523a7b | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 8060020240329182634.60523a7b | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 8080020240329143735.693a3987 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 11.5.0-2.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 11.0.6-3.el9_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 11.3.0-2.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
- keycloak Vendor— Affected before 11.5.1 Fixed in 11.5.1 Patch available CNA
- Red Hat Certificate System 10.4 EUS for RHEL-8 VendorRed Hat Affected — Fixed in 8060020240529205458.07fb4edf Patch available CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 10.5.18-32.el7_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020240614102443.82f485b7 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020240329193548.17df0a3f Patch available CNA
- Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8040020240329193548.17df0a3f Patch available CNA
- Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8040020240329193548.17df0a3f Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8060020240329182634.60523a7b Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8060020240329182634.60523a7b Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8060020240329182634.60523a7b Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 8080020240329143735.693a3987 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 11.5.0-2.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 11.0.6-3.el9_0 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 11.3.0-2.el9_2 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE names CNA · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:certificate_system_eus:10.4::el8 | 10.4 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:7::client | 7 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:7::computenode | 7 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:7::server | 7 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:7::workstation | 7 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8::appstream | 8 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.4::appstream | 8.4 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:8.4::appstream | 8.4 | — | Red Hat |
| cpe:/a:redhat:rhel_tus:8.4::appstream | 8.4 | — | Red Hat |
| cpe:/a:redhat:rhel_aus:8.6::appstream | 8.6 | — | Red Hat |
- cpe:/a:redhat:certificate_system_eus:10.4::el8 Versions 10.4 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:7::client Versions 7 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:7::computenode Versions 7 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:7::server Versions 7 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:7::workstation Versions 7 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:8.4::appstream Versions 8.4 — ·Red Hat
- cpe:/a:redhat:rhel_tus:8.4::appstream Versions 8.4 — ·Red Hat
- cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:rhel_e4s:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_tus:8.6::appstream | 8.6 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:8.8::appstream | 8.8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.0::appstream | 9.0 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:9.2::appstream | 9.2 | — | Red Hat |
| cpe:/o:redhat:rhel_els:6 | 6 | — | Red Hat |
- cpe:/a:redhat:rhel_e4s:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_tus:8.6::appstream Versions 8.6 — ·Red Hat
- cpe:/a:redhat:rhel_eus:8.8::appstream Versions 8.8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
- cpe:/a:redhat:rhel_eus:9.2::appstream Versions 9.2 — ·Red Hat
- cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
Remediation
- Fix · CNA keycloak Fixed in 11.5.1
Red Hat 9 advisories
- RHSA-2024:4413 Released 2024-07-09 · Red Hat rating Importantpki-core security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) pki-acme-11.0.6-3.el9_0, pki-base-11.0.6-3.el9_0, pki-base-java-11.0.6-3.el9_0 +7
- RHSA-2024:4403 Released 2024-07-09 · Red Hat rating Importantpki-core security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) jss-4.9.3-1.module+el8.6.0+21627+1e66fa4f.src::pki-core:10.6, jss-4.9.3-1.module+el8.6.0+21627+1e66fa4f.x86_64::pki-core:10.6, jss-javadoc-4.9.3-1.module+el8.6.0+21627+1e66fa4f.x86_64::pki-core:10.6 +15
- Red Hat Enterprise Linux AppStream E4S (v.8.6) jss-4.9.3-1.module+el8.6.0+21627+1e66fa4f.ppc64le::pki-core:10.6, jss-4.9.3-1.module+el8.6.0+21627+1e66fa4f.src::pki-core:10.6, jss-4.9.3-1.module+el8.6.0+21627+1e66fa4f.x86_64::pki-core:10.6 +19
- Red Hat Enterprise Linux AppStream TUS (v.8.6) jss-4.9.3-1.module+el8.6.0+21627+1e66fa4f.src::pki-core:10.6, jss-4.9.3-1.module+el8.6.0+21627+1e66fa4f.x86_64::pki-core:10.6, jss-javadoc-4.9.3-1.module+el8.6.0+21627+1e66fa4f.x86_64::pki-core:10.6 +15
- RHSA-2024:4367 Released 2024-07-08 · Red Hat rating Importantpki-core security update
- Red Hat Enterprise Linux AppStream (v. 8) idm-jss-4.11.0-1.module+el8.10.0+21280+cce842b8.aarch64::pki-core:10.6, idm-jss-4.11.0-1.module+el8.10.0+21280+cce842b8.ppc64le::pki-core:10.6, idm-jss-4.11.0-1.module+el8.10.0+21280+cce842b8.s390x::pki-core:10.6 +30
Show 6 more Red Hat advisories
- RHSA-2024:4222 Released 2024-07-02 · Red Hat rating Importantpki-core security update
- Red Hat Enterprise Linux Client Optional (v. 7) pki-base-10.5.18-32.el7_9, pki-base-java-10.5.18-32.el7_9, pki-ca-10.5.18-32.el7_9 +6
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) pki-base-10.5.18-32.el7_9, pki-base-java-10.5.18-32.el7_9, pki-ca-10.5.18-32.el7_9 +6
- Red Hat Enterprise Linux Server (v. 7) pki-base-10.5.18-32.el7_9, pki-base-java-10.5.18-32.el7_9, pki-ca-10.5.18-32.el7_9 +5
- Red Hat Enterprise Linux Server Optional (v. 7) pki-base-10.5.18-32.el7_9, pki-base-java-10.5.18-32.el7_9, pki-ca-10.5.18-32.el7_9 +6
- Red Hat Enterprise Linux Workstation (v. 7) pki-base-10.5.18-32.el7_9, pki-base-java-10.5.18-32.el7_9, pki-ca-10.5.18-32.el7_9 +5
- Red Hat Enterprise Linux Workstation Optional (v. 7) pki-javadoc-10.5.18-32.el7_9
- RHSA-2024:4179 Released 2024-07-01 · Red Hat rating Importantpki-core security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) idm-pki-acme-10.14.3-2.module+el8.8.0+21626+a79c8682.noarch::pki-core:10.6, idm-pki-base-10.14.3-2.module+el8.8.0+21626+a79c8682.noarch::pki-core:10.6, idm-pki-base-java-10.14.3-2.module+el8.8.0+21626+a79c8682.noarch::pki-core:10.6 +27
- RHSA-2024:4165 Released 2024-06-27 · Red Hat rating Importantpki-core security update
- Red Hat Enterprise Linux AppStream (v. 9) idm-pki-acme-11.5.0-2.el9_4, idm-pki-base-11.5.0-2.el9_4, idm-pki-ca-11.5.0-2.el9_4 +7
- RHSA-2024:4164 Released 2024-06-27 · Red Hat rating Importantpki-core security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.src::pki-core:10.6, jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64::pki-core:10.6, jss-javadoc-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64::pki-core:10.6 +15
- Red Hat Enterprise Linux AppStream E4S (v.8.4) jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.ppc64le::pki-core:10.6, jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.src::pki-core:10.6, jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64::pki-core:10.6 +19
- Red Hat Enterprise Linux AppStream TUS (v.8.4) jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.src::pki-core:10.6, jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64::pki-core:10.6, jss-javadoc-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64::pki-core:10.6 +15
- RHSA-2024:4070 Released 2024-06-24 · Red Hat rating ImportantRed Hat Certificate System 10.4 for RHEL 8 security and bug fix update
- Red Hat Certificate System 10.4 EUS for RHEL 8 idm-console-framework-1.3.0-1.module+el8pki+14677+1ef79a68.noarch::redhat-pki:10, idm-console-framework-1.3.0-1.module+el8pki+14677+1ef79a68.src::redhat-pki:10, jss-4.9.10-1.module+el8pki+21949+4b2d0700.src::redhat-pki:10 +26
- RHSA-2024:4051 Released 2024-06-23 · Red Hat rating Importantpki-core security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) idm-pki-acme-11.3.0-2.el9_2, idm-pki-base-11.3.0-2.el9_2, idm-pki-ca-11.3.0-2.el9_2 +7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Certificate System 10.4 EUS for RHEL 8 | Fixed | RHSA-2024:4070 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:4367 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:4165 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2024:4164 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2024:4403 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2024:4164 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2024:4403 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2024:4413 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:4179 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:4051 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2024:4164 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2024:4403 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2024:4222 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2024:4222 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:4222 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2024:4222 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:4222 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2024:4222 |
Not affected: 1 product
- Red Hat Enterprise Linux AppStream E4S (v.8.6)
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4727
- 2026-10-03 Alias added: GHSA-rvm7-rc5g-c98q
- 2026-11-07 Affected versions changed · Red Hat
References
Advisory 9
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-4727 · CVE Program
- CVE-2023-4727 · NVD
- FIRST EPSS
- GHSA-rvm7-rc5g-c98q · GitHub Advisory Database · CC BY 4.0
- CVE-2023-4727 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences