PT-2020-12283 · Red Hat · Keycloak

Published 2020-05-04 · Updated 2022-08-05 · CVE-2020-10686

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Keycloak versions 8.0.2 through 9.0.0

Description A flaw was found where a malicious user can register as oneself and then use the "remove devices" form to post different credential IDs with the hope of removing MFA devices for other users.

Recommendations For Keycloak versions 8.0.2 through 9.0.0, update to Keycloak version 9.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the "remove devices" form until a patch is available.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2020-10686

GHSA-9695-W6H2-JPV9

Affected Products

Keycloak

References · 7

• https://osv.dev/vulnerability/GHSA-9695-w6h2-jpv9 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10686 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10686 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/5ddd605ee96b8551c7eb00b609a0b97939925b77 · Note
• https://t.me/cvenotify/3548 · Telegram Post