Keycloak vulnerable to LDAP Injection on UsernameForm Login

GHSA-8hc5-rmgf-qx6p · CVE-2022-2232

Published Nov 29, 2023 · Modified Dec 4, 2024

Description

A flaw was found in the Keycloak package. This flaw allows an attacker to benefit from an LDAP query and access existing usernames in the server.

References

Affected Packages

Maven/org.keycloak:keycloak-ldap-federation

Fix 23.0.1

Introduced 0

151 affected versions

1.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final +131 more

Maven/org.keycloak:keycloak-services

Fix 23.0.1

Introduced 0

161 affected versions

1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-41.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta1 +141 more

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes