PT-2021-10083 · Red Hat · Keycloak

Published 2021-01-28 · Updated 2022-02-09 · CVE-2020-1725

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 13.0.0

Description: A flaw was found in Keycloak where a user may still have access to a resource after changing the role mappings and after the expiration of the previous access token.

Recommendations: For versions prior to 13.0.0, update to version 13.0.0 or later to resolve the issue.

Fix

Incorrect Authorization

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-863

CWE-668

Related Identifiers

CVE-2020-1725

GHSA-P225-PC2X-4JPM

Affected Products

Keycloak

References · 7

• https://osv.dev/vulnerability/CVE-2020-1725 · Vendor Advisory
• https://issues.redhat.com/browse/KEYCLOAK-16550 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1725 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1765129 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p225-pc2x-4jpm · Vendor Advisory
• https://t.me/cvenotify/12384 · Telegram Post
• https://t.me/cibsecurity/22810 · Telegram Post