PT-2020-14912 · Red Hat · Keycloak

Published 2020-05-12 · Updated 2022-02-09 · CVE-2020-1718

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 8.0.0

Description A flaw was found in the reset credential flow, allowing an attacker to gain unauthorized access to the application.

Recommendations For versions prior to 8.0.0, update to version 8.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the reset credential flow until a patch is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-1718

GHSA-J229-2H63-RVH9

RHSA-2020:2106

RHSA-2020:2107

RHSA-2020:2108

Affected Products

Keycloak

References · 5

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j229-2h63-rvh9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1718 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1718 · Vendor Advisory
• https://t.me/cvenotify/3726 · Telegram Post