Vulnerability in Bouncycastle Bc-java
CVE-2023-33201
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation…
Vulnerability class: Improper Certificate Validation
EPSS: 0.008 (51.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Bouncycastle Bc-java
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product)
- cve@mitre.org (Patch)
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (mailing-list)
- cve@mitre.org
Frequently asked questions
- What is CVE-2023-33201?
- CVE-2023-33201 is a medium-severity vulnerability in Bouncycastle Bc-java, classified under Improper Certificate Validation. CVSS score: 5.3/10. Published 2023-07-05.
- How severe is CVE-2023-33201?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-33201 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.