---
id: CVE-2023-4727
title: A flaw was found in dogtag-pki and pki-core
summary: >-
  A flaw was found in dogtag-pki and pki-core. The token authentication scheme
  can be bypassed with a LDAP injection. By passing the query string parameter
  sessionID=*, an attacker can authenticate with an existing session saved in
  the LDA…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-305
published: '2024-06-11'
updated: '2026-06-26'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-4727'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:4051'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4070'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4164'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4165'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4179'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4222'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4367'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4403'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4413'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2023-4727'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2232218'
    label: secalert@redhat.com
  - url: 'https://github.com/advisories/GHSA-rvm7-rc5g-c98q'
    label: secalert@redhat.com
  - url: >-
      https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720
    label: secalert@redhat.com
  - url: >-
      https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2024:4051'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2024:4070'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2024:4164'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2024:4165'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2024:4179'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2024:4222'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2024:4367'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2024:4403'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2024:4413'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/security/cve/CVE-2023-4727'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2232218'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00665
epssPercentile: 0.50388
ingestedAt: '2026-06-26T16:43:13.389Z'
---

## Overview

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.