PT-2021-13837 · Red Hat · Keycloak

Jlleitschuh + 2 · Published 2021-05-12 · Updated 2022-03-18 · CVE-2021-20202

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: keycloak (affected versions not specified) redhat keycloak (affected versions not specified)

Description: A flaw was found in keycloak, allowing directories to be created with wider user permissions in the temporary directory before the Java process creates them. This gives an attacker access to the contents stored by keycloak in this directory, posing a threat to data confidentiality and integrity.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-377

Related Identifiers

CVE-2021-20202

GHSA-6XP6-FMC8-PMMR

Affected Products

Keycloak

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-20202 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1922128 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6xp6-fmc8-pmmr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20202 · Vendor Advisory
• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-7gf3-89f6-823j · Note
• https://issues.redhat.com/browse/KEYCLOAK-17000 · Note