PT-2021-13862 · Red Hat · Keycloak

Paramvir Jindal + 1 · Published 2021-03-09 · Updated 2021-03-15 · CVE-2021-20262

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Keycloak version 12.0.0

Description: A flaw was found in Keycloak where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Recommendations: For Keycloak version 12.0.0, consider implementing additional authentication measures to prevent account takeover, such as requiring re-authentication before password updates. As a temporary workaround, restrict access to password update functionality until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-20262

GHSA-XF46-8VVP-4HXX

Affected Products

Keycloak

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-20262 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1933639 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20262 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xf46-8vvp-4hxx · Vendor Advisory