PT-2020-14897 · Red Hat · Keycloak

Paramvir Jindal · Published 2020-09-16 · Updated 2022-02-09 · CVE-2020-1694

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 10.0.0

Description A flaw was found in Keycloak where the NodeJS adapter did not support the verify-token-audience. This results in some users having access to sensitive information outside of their permissions.

Recommendations For versions prior to 10.0.0, update to version 10.0.0 or later to resolve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-183

Related Identifiers

CVE-2020-1694

GHSA-72J4-94RX-CR6W

Affected Products

Keycloak

References · 4

• https://osv.dev/vulnerability/CVE-2020-1694 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1790759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1694 · Security Note
• https://osv.dev/vulnerability/GHSA-72j4-94rx-cr6w · Vendor Advisory