PT-2022-13745 · Red Hat · Keycloak

Knutz3N · Published 2022-04-25 · Updated 2023-06-27 · CVE-2022-1245

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A privilege escalation flaw was found in the token exchange feature of Keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client id of the target. This could allow a client to gain unauthorized access to additional services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-862

CWE-863

Related Identifiers

CVE-2022-1245

GHSA-75P6-52G3-RQC8

RHSA-2022:1711

RHSA-2022:1712

Affected Products

Keycloak

References · 9

• https://osv.dev/vulnerability/CVE-2022-1245 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-75p6-52g3-rqc8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1245 · Security Note
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-75p6-52g3-rqc8 · Note
• https://github.com/keycloak/keycloak/commit/76d83f46fad94ebcbedaa49e6daad458e2894e52 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1245 · Note
• https://t.me/cvenotify/32756 · Telegram Post
• https://t.me/cibsecurity/45799 · Telegram Post