CVE-2022-2232CWE-20

Keycloak: ldap injection on username input

High · published November 14, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00651 · 50.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-11-14T14:51Z
EPSS history
Timeline
  • 14 NOV 14:51Z
    Keycloak: ldap injection on username input
    cvelistv5