High severity · published Nov 14, 2024
CVE-2022-2232
Keycloak: ldap injection on username input
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Single Sign-On 7 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2232
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2232
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:0094
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:0095
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:0096
access.redhat.com
https://access.redhat.com/security/cve/CVE-2022-2232
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2096994
More from Red Hat Single Sign-On 7
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-42581
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
9.8
CVE-2026-33228
flatted: Prototype Pollution via parse()
9.8
CVE-2026-27606
Rollup 4 has Arbitrary File Write via Path Traversal
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf