What’s Vulnerable › Vulnerabilities
CVE-2023-4727: Ca: token authentication bypass vulnerability
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-06-11 · updated 2026-06-26
- Weakness: CWE-305
Description
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.
Affected products
- Red Hat Certificate System 10.4 EUS for RHEL-8: all versions — fixed in 8060020240529205458.07fb4edf
- Red Hat Enterprise Linux 7: all versions — fixed in 0:10.5.18-32.el7_9
- Red Hat Enterprise Linux 8: all versions — fixed in 8100020240614102443.82f485b7
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 8040020240329193548.17df0a3f
- Red Hat Enterprise Linux 8.4 Telecommunications Update Service: all versions — fixed in 8040020240329193548.17df0a3f
- Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions: all versions — fixed in 8040020240329193548.17df0a3f
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 8060020240329182634.60523a7b
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service: all versions — fixed in 8060020240329182634.60523a7b
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: all versions — fixed in 8060020240329182634.60523a7b
- Red Hat Enterprise Linux 8.8 Extended Update Support: all versions — fixed in 8080020240329143735.693a3987
- Red Hat Enterprise Linux 9: all versions — fixed in 0:11.5.0-2.el9_4
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: all versions — fixed in 0:11.0.6-3.el9_0
- Red Hat Enterprise Linux 9.2 Extended Update Support: all versions — fixed in 0:11.3.0-2.el9_2
How to fix
Upgrade to a fixed version: Red Hat Certificate System 10.4 EUS for RHEL-8 8060020240529205458.07fb4edf; Red Hat Enterprise Linux 7 0:10.5.18-32.el7_9; Red Hat Enterprise Linux 8 8100020240614102443.82f485b7; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020240329193548.17df0a3f; Red Hat Enterprise Linux 8.4 Telecommunications Update Service 8040020240329193548.17df0a3f; Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 8040020240329193548.17df0a3f; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020240329182634.60523a7b; Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020240329182634.60523a7b; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020240329182634.60523a7b; Red Hat Enterprise Linux 8.8 Extended Update Support 8080020240329143735.693a3987; Red Hat Enterprise Linux 9 0:11.5.0-2.el9_4; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:11.0.6-3.el9_0. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2024:4051
- https://access.redhat.com/errata/RHSA-2024:4070
- https://access.redhat.com/errata/RHSA-2024:4164
- https://access.redhat.com/errata/RHSA-2024:4165
- https://access.redhat.com/errata/RHSA-2024:4179
- https://access.redhat.com/errata/RHSA-2024:4222
- https://access.redhat.com/errata/RHSA-2024:4367
- https://access.redhat.com/errata/RHSA-2024:4403
- https://access.redhat.com/errata/RHSA-2024:4413
- https://access.redhat.com/security/cve/CVE-2023-4727
- https://bugzilla.redhat.com/show_bug.cgi?id=2232218
- https://github.com/advisories/GHSA-rvm7-rc5g-c98q
Get alerted when CVE-2023-4727 or the next vulnerability affects your stack