PT-2023-20194 · Apache · Apache Derby

4Ra1N · Published 2023-02-20 · Updated 2025-08-11 · CVE-2023-25613

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Kerby versions prior to 2.0.3

Description An LDAP Injection issue exists in the LdapIdentityBackend of Apache Kerby. This allows for potential exploitation.

Recommendations For versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the LdapIdentityBackend until a patch is applied.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-25613

GHSA-337F-XR2X-6FCF

Affected Products

Apache Derby

References · 10

• https://lists.apache.org/thread/ynz3hhbbq6d980fzpncwbh5jd8mkyt5y · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25613 · Security Note
• https://osv.dev/vulnerability/GHSA-337f-xr2x-6fcf · Vendor Advisory
• https://github.com/apache/directory-kerby · Note
• https://t.me/cvenotify/44681 · Telegram Post
• https://t.me/cveNotify/131659 · Telegram Post
• https://t.me/cvenotify/68579 · Telegram Post
• https://t.me/cibsecurity/58525 · Telegram Post
• https://t.me/breachdetector/207052 · Telegram Post