PT-2023-16014 · Red Hat · Keycloak

Willem Noort · Publicado 2023-01-11 · Atualizado 2023-07-18 · CVE-2023-0105

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in Keycloak allows impersonation and lockout due to incorrect handling of email trust. This issue enables an attacker to shadow other users with the same email, potentially leading to lockout or impersonation. The problem arises because the verified state of an email is not reset when the email changes, allowing users to shadow others with the same email.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-841

Identificadores relacionados

CVE-2023-0105

GHSA-C7XW-P58W-H6FJ

GHSA-VHVQ-JH34-3FC8

RHSA-2023:7482

RHSA-2023:7483

RHSA-2023:7484

Produtos afetados

Keycloak

Referências · 11

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988 · Nota
• https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj · Nota
• https://access.redhat.com/security/cve/CVE-2023-0105 · Aviso do Fabricante
• https://t.me/cvenotify/42674 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0105 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vhvq-jh34-3fc8 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0105 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2158910 · Nota
• https://osv.dev/vulnerability/GHSA-c7xw-p58w-h6fj · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-0105 · Aviso do Fabricante