PT-2019-4633 · Red Hat · Keycloak

Publicado 2019-12-04 · Atualizado 2022-05-24 · CVE-2019-14909

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak versions 7.x

Description A vulnerability was found in the user federation LDAP bind type, where any password will be accepted if the LDAP bind type is set to none (LDAP anonymous bind). The issue is related to errors in the implementation of the authentication procedure, which can allow a remote attacker to elevate their privileges.

Recommendations For Keycloak version 7.x, consider changing the LDAP bind type from none to a more secure option to mitigate the risk of exploitation. As a temporary workaround, restrict access to the LDAP authentication mechanism until a proper fix is applied.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-305

CWE-592

Identificadores relacionados

BDU:2020-00794

CVE-2019-14909

GHSA-FV4Q-WM8C-WJG4

Produtos afetados

Keycloak

Referências · 7

• https://github.com/keycloak/keycloak · Nota
• https://osv.dev/vulnerability/GHSA-fv4q-wm8c-wjg4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14909 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00794 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-14909 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909 · Nota
• https://access.redhat.com/security/cve/cve-2019-14909 · Nota