PT-2023-16006 · Keycloak+1 · Keycloak

Sourav Kumar · Publicado 2023-01-11 · Atualizado 2023-02-22 · CVE-2023-0091

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak where it did not properly check client tokens for possible revocation in its client credential flow. This allows an attacker to access or modify potentially sensitive information. Specifically, when a service account with the create-client or manage-clients role uses the client-registration endpoints to create or manage clients with an access token, and if the access token is leaked, there is an option to revoke the specific token. However, the check is not performed in client-registration endpoints, such as "/api/v1/client-registration".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Access Control

Enumeração de Fraquezas

CWE-863

CWE-284

Identificadores relacionados

CVE-2023-0091

GHSA-V436-Q368-HVGG

RHSA-2023:1043

RHSA-2023:1044

RHSA-2023:1045

Produtos afetados

Keycloak

Referências · 7

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-0091 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0091 · Nota
• https://access.redhat.com/security/cve/CVE-2023-0091 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-0091 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-v436-q368-hvgg · Aviso do Fabricante