PT-2021-11420 · Red Hat · Keycloak

Published 2021-05-28 · Updated 2022-03-18 · CVE-2020-27826

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 12.0.0

Description: A flaw was found in Keycloak where it is possible to update the user's metadata attributes using the Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.

Recommendations: For versions prior to 12.0.0, update to version 12.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Account REST API to minimize the risk of exploitation. Avoid using the NameID attribute in the affected API endpoint until the issue is resolved.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2020-27826

GHSA-M9CJ-V55F-8X26

RHSA-2020:5526

RHSA-2020:5527

RHSA-2020:5528

Affected Products

Keycloak

References · 7

• https://bugzilla.redhat.com/show_bug.cgi?id=1905089 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m9cj-v55f-8x26 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27826 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27826 · Vendor Advisory
• https://github.com/keycloak/keycloak/commit/dae4a3eaf26590b8d441b8e4bec3b700ee303b72 · Note
• https://t.me/cvenotify/15184 · Telegram Post
• https://access.redhat.com/security/cve/cve-2020-27826 · Note