Executive brief
Keycloak vulnerable to LDAP Injection on UsernameForm Login
Affected products
- Maven org.keycloak:keycloak-ldap-federation
- Maven org.keycloak:keycloak-services
Junglewise Threat Intelligence
CVE-2022-2232: Keycloak vulnerable to LDAP Injection on UsernameForm Login
CVE-2022-2232 · Severity: info · Published 2023-11-29
Technologies: org.keycloak:keycloak-ldap-federation (Maven), org.keycloak:keycloak-services (Maven). Vendors: Maven.
Related threats
- Keycloak information disclosure via user profile permission bypass in group members endpoint
- Keycloak privilege escalation in Fine-Grained Admin Permissions scope mapping
- Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement
- Keycloak denial of service via malformed LDAP password policy response
- Keycloak privilege escalation in Fine-Grained Admin Permissions