PT-2020-14914 · Red Hat · Keycloak+3

Paramvir Jindal · Published 2020-05-11 · Updated 2022-05-24 · CVE-2020-1724

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 9.0.2 Redhat Keycloak (affected versions not specified) Redhat Openshift Application Runtimes (affected versions not specified) Redhat Single Sign-On (affected versions not specified)

Description A flaw in the software allows a malicious user who is currently logged in to see the personal information of a previously logged out user in the account manager section.

Recommendations For Keycloak versions prior to 9.0.2, update to version 9.0.2 or later to resolve the issue. At the moment, there is no information about a newer version that contains a fix for Redhat Keycloak, Redhat Openshift Application Runtimes, and Redhat Single Sign-On.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-1724

GHSA-8XJ2-47XW-Q78C

RHSA-2020:2106

RHSA-2020:2107

RHSA-2020:2108

Affected Products

Keycloak

Red Hat Keycloak

Redhat Openshift Application Runtimes

Red Hat Single Sign-On

References · 5

• https://osv.dev/vulnerability/GHSA-8xj2-47xw-q78c · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1724 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1724 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note