PT-2022-13909 · Red Hat · Red Hat Single Sign-On+1

Christian Dölling · Published 2022-04-26 · Updated 2022-05-06 · CVE-2022-1466

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Single Sign-On (affected versions not specified)

Description The issue is related to improper authorization, allowing users to perform actions they should not be allowed to. Specifically, it was possible to add users to the master realm without having the respective permission granted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-1466

GHSA-F32V-VF79-P29Q

Affected Products

Keycloak

Red Hat Single Sign-On

References · 8

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-076.txt · Exploit
• 🔥 https://syss.de/pentest-blog/fehlerhafte-autorisierung-bei-red-hat-single-sign-on-750ga-syss-2021-076 · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=2050228 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1466 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1466 · Security Note
• https://osv.dev/vulnerability/GHSA-f32v-vf79-p29q · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://t.me/cibsecurity/41452 · Telegram Post