PT-2019-13853 · Red Hat · Keycloak

Chess Hazlett · Publicado 2019-10-15 · Atualizado 2022-05-24 · CVE-2019-14832

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 8.0.0 Keycloak versions prior to 7.0.1

Description A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

Recommendations For versions prior to 7.0.1, update to version 7.0.1 or later. For versions prior to 8.0.0, update to version 8.0.0 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2019-14832

GHSA-8PRC-58J4-M55Q

RHSA-2019:3044

RHSA-2019:3045

RHSA-2019:3046

Produtos afetados

Keycloak

Referências · 6

• https://github.com/keycloak/keycloak/commit/0b73685ccf3181115ae3936a578708630215ac23 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14832 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14832 · Nota
• https://osv.dev/vulnerability/GHSA-8prc-58j4-m55q · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14832 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14832 · Aviso do Fabricante