PT-2019-3221 · Red Hat · Keycloak

Published

2019-07-10

·

Updated

2020-10-02

·

CVE-2019-10201

CVSS v2.0

8.5

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions Keycloak versions up to 6.0.1
Description The issue is related to the SAML broker component, which does not properly verify missing message signatures. This allows an attacker to modify the SAML Response by removing the <Signature> sections, and the message is still accepted. As a result, the message can be modified, potentially enabling an attacker to impersonate other users and gain unauthorized access to sensitive information. The vulnerability is related to incorrect authentication in the SAML broker component, which can be exploited by a remote attacker to gain unauthorized access to the system by modifying the SAML response.
Recommendations For Keycloak versions up to 6.0.1, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2019-03210
CVE-2019-10201
GHSA-4FGQ-GQ9G-3RW7

Affected Products

Keycloak