PT-2019-13853 · Red Hat · Keycloak

Chess Hazlett · Published 2019-10-15 · Updated 2022-05-24 · CVE-2019-14832

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 8.0.0 Keycloak versions prior to 7.0.1

Description A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

Recommendations For versions prior to 7.0.1, update to version 7.0.1 or later. For versions prior to 8.0.0, update to version 8.0.0 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2019-14832

GHSA-8PRC-58J4-M55Q

RHSA-2019:3044

RHSA-2019:3045

RHSA-2019:3046

Affected Products

Keycloak

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-14832 · Security Note
• https://osv.dev/vulnerability/GHSA-8prc-58j4-m55q · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14832 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14832 · Vendor Advisory
• https://github.com/keycloak/keycloak/commit/0b73685ccf3181115ae3936a578708630215ac23 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14832 · Note