PT-2020-2764 · Red Hat · Keycloak

Marian Rehak + 1 · Published 2020-01-07 · Updated 2022-05-24 · CVE-2019-14837

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 8.0.0

Description A flaw in Keycloak allows the owner of a domain to set up a mail server and reset a client's password, knowing only the client's name. For instance, a client named 'test' would have an email address like '[e-mail]'. This issue is related to the use of predefined registration data, which can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 8.0.0, update to version 8.0.0 or later to resolve the issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-547

Related Identifiers

BDU:2020-02856

CVE-2019-14837

GHSA-CF8F-W2C5-P5JR

RHSA-2019:4040

RHSA-2019:4041

RHSA-2019:4042

Affected Products

Keycloak

References · 9

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14837 · Exploit
• https://github.com/keycloak/keycloak/commit/9a7c1a91a59ab85e7f8889a505be04a71580777f · Patch
• https://issues.jboss.org/browse/KEYCLOAK-10780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14837 · Security Note
• https://bdu.fstec.ru/vul/2020-02856 · Security Note
• https://osv.dev/vulnerability/GHSA-cf8f-w2c5-p5jr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14837 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://access.redhat.com/security/cve/cve-2019-14837 · Note