PT-2022-11382 · Red Hat · Keycloak

Published 2021-12-20 · Updated 2022-09-03 · CVE-2021-4133

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak versions 12.0.0 through 15.1.1

Description A flaw was found in Keycloak that allows an attacker with any existing user account to create new default user accounts via the administrative REST API, even when new user registration is disabled.

Recommendations For Keycloak versions 12.0.0 through 15.1.1, consider disabling the administrative REST API until a patch is available. Restrict access to the administrative REST API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-4133

GHSA-83X4-9CWR-5487

RHSA-2021:5218

RHSA-2021:5219

RHSA-2022:0151

RHSA-2022:0152

Affected Products

Keycloak

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2021-4133 · Security Note
• https://osv.dev/vulnerability/GHSA-83x4-9cwr-5487 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4133 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 · Note
• https://github.com/keycloak/keycloak/issues/9247 · Note
• https://t.me/cvenotify/29177 · Telegram Post
• https://t.me/cibsecurity/36258 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4133 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2033602 · Note
• https://oracle.com/security-alerts/cpuapr2022.html · Note