CVE-2023-4727

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4727.json",
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-305"
    ]
}

References

Affected packages

Git / github.com/dogtagpki/pki

Affected ranges

Type

GIT

Repo

https://github.com/dogtagpki/pki

Events

Introduced

Fixed

54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720

Fixed

aa7161ba378caf5cf0471aafb679a842679c8388

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "11.5.1"
        }
    ]
}

Affected versions

Other

DOGTAG_10_0_0_ALPHA_FEDORA_16_17_20120314

DOGTAG_10_0_2_FEDORA_18_19_20130507

DOGTAG_10_1_0_BETA_20131111

DOGTAG_10_1_0_BETA_FEDORA_20_20131111

DOGTAG_10_1_0_GA_FEDORA_20_20131121

DOGTAG_10_2_0_ALPHA_FEDORA_21_20140909

DOGTAG_10_2_1_FEDORA_22_20150108

DOGTAG_10_2_20150808

DOGTAG_10_2_2_FEDORA_22_20150318

DOGTAG_10_2_3_FEDORA_22_20150423

DOGTAG_10_2_4_FEDORA_22_20150526

DOGTAG_10_2_5_FEDORA_22_20150619

DOGTAG_10_2_6_FEDORA_22_23_20150718

DOGTAG_10_3_0_FEDORA_24_20160516

DOGTAG_10_3_0_a1_FEDORA_24_ALPHA_20160307

DOGTAG_10_3_0_a2_FEDORA_24_ALPHA_20160407

DOGTAG_10_3_0_b1_FEDORA_24_BETA_20160418

DOGTAG_10_3_1_FEDORA_24_20160517

DOGTAG_10_3_2_FEDORA_24_20160607

DOGTAG_10_3_3_FEDORA_24_20160620

DOGTAG_10_3_4_FEDORA_24_20160705

DOGTAG_10_3_5_FEDORA_24_20160808

DOGTAG_10_4_8_FEDORA_27

DOGTAG_10_4_FEDORA_27_20170331

DOGTAG_10_4_FEDORA_27_20170413

DOGTAG_10_4_FEDORA_27_20170501

DOGTAG_10_4_FEDORA_27_20170509

DOGTAG_10_4_FEDORA_27_20170522

DOGTAG_10_4_FEDORA_27_20170530

DOGTAG_10_4_FEDORA_27_20170605

DOGTAG_10_4_FEDORA_27_20170612

DOGTAG_10_5_0_FEDORA_27

DOGTAG_10_5_1_FEDORA_27

pki-core-10.*

pki-core-10.2.0-3

pki-core-10.2.1-0.1

v10.*

v10.0.2

v10.1.0

v10.10.0

v10.10.0-b1

v10.10.1

v10.11.0-alpha1

v10.11.0-alpha2

v10.2.0

v10.2.1

v10.2.2

v10.2.3

v10.2.4

v10.2.5

v10.2.6

v10.3.0

v10.3.1

v10.3.2

v10.3.3

v10.3.4

v10.3.5

v10.4.1

v10.4.2

v10.4.3

v10.4.4

v10.4.5

v10.4.6

v10.4.7

v10.4.8

v10.5.0

v10.5.1

v10.5.2

v10.5.3

v10.6.0

v10.6.0-beta

v10.6.0-beta2

v10.6.0-rc

v10.6.1

v10.6.2

v10.6.3

v10.6.4

v10.6.5

v10.6.6

v10.6.7

v10.6.8

v10.6.9

v10.7.0

v10.7.1

v10.7.2

v10.8.0

v10.8.0-a1

v10.8.0-a2

v10.8.0-b1

v10.8.0-b2

v10.8.0-b3

v10.8.1

v10.8.2

v10.9.0

v10.9.0-a1

v10.9.0-a2

v10.9.0-b1

v10.9.0-b2

v10.9.0-b3

v10.9.0-b4

v11.*

v11.0.0

v11.0.0-alpha1

v11.0.0-beta1

v11.1.0

v11.1.0-alpha1

v11.1.0-alpha2

v11.2.0-beta1

v11.2.0-beta2

v11.2.0-beta3

v11.3.0-beta1

v11.4.0

v11.4.0-alpha1

v11.5.0

v11.5.0-alpha1

v11.5.0-alpha2

v11.5.0-alpha3

v11.5.0-alpha4

v11.5.0-alpha5

v11.5.0-alpha6

v11.5.0-alpha7

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "159929905925728052316151616387447793014",
                "113095399420068434420381245555077035978",
                "288783561434776018263235974094856668653",
                "260411814325342437038561811612076220899",
                "298691720800095042077601500153425280985",
                "282899423113382899287314268677515942293",
                "5592907713344490912007962262607983349",
                "158901841031943750396144694674860046702",
                "298691720800095042077601500153425280985",
                "92982385441739889376753730948398713376",
                "280365455956133149241511346987472086766",
                "220755669660904726396283238114078783908"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-4727-08dbced1",
        "target": {
            "file": "base/server/src/main/java/com/netscape/cmscore/session/LDAPSecurityDomainSessionTable.java"
        },
        "source": "https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 891.0,
            "function_hash": "232994835997540767755135353028017056674"
        },
        "id": "CVE-2023-4727-0b7f747c",
        "target": {
            "function": "getStringValue",
            "file": "base/server/src/main/java/com/netscape/cmscore/session/LDAPSecurityDomainSessionTable.java"
        },
        "source": "https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "159929905925728052316151616387447793014",
                "113095399420068434420381245555077035978",
                "288783561434776018263235974094856668653",
                "260411814325342437038561811612076220899",
                "298691720800095042077601500153425280985",
                "282899423113382899287314268677515942293",
                "5592907713344490912007962262607983349",
                "158901841031943750396144694674860046702",
                "298691720800095042077601500153425280985",
                "92982385441739889376753730948398713376",
                "280365455956133149241511346987472086766",
                "220755669660904726396283238114078783908"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-4727-3fb422af",
        "target": {
            "file": "base/server/src/main/java/com/netscape/cmscore/session/LDAPSecurityDomainSessionTable.java"
        },
        "source": "https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 891.0,
            "function_hash": "232994835997540767755135353028017056674"
        },
        "id": "CVE-2023-4727-634701ab",
        "target": {
            "function": "getStringValue",
            "file": "base/server/src/main/java/com/netscape/cmscore/session/LDAPSecurityDomainSessionTable.java"
        },
        "source": "https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 654.0,
            "function_hash": "111222733731203503158836197018858573424"
        },
        "id": "CVE-2023-4727-66d12c05",
        "target": {
            "function": "sessionExists",
            "file": "base/server/src/main/java/com/netscape/cmscore/session/LDAPSecurityDomainSessionTable.java"
        },
        "source": "https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 654.0,
            "function_hash": "111222733731203503158836197018858573424"
        },
        "id": "CVE-2023-4727-d4b8c163",
        "target": {
            "function": "sessionExists",
            "file": "base/server/src/main/java/com/netscape/cmscore/session/LDAPSecurityDomainSessionTable.java"
        },
        "source": "https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-4727.json"

vanir_signatures_modified

"2026-08-12T14:51:29Z"