PT-2022-7282 · Red Hat · Keycloak

Abstractj · Published 2022-04-25 · Updated 2022-11-30 · CVE-2021-3827

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials, specifically the username and password. The highest threat from this issue is to confidentiality and integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-02260

CVE-2021-3827

GHSA-4PC7-VQV5-5R3V

RHSA-2022:0151

RHSA-2022:0152

Affected Products

Keycloak

References · 11

• https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0d · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2007512 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3827 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02260 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-3827 · Security Note
• https://osv.dev/vulnerability/GHSA-4pc7-vqv5-5r3v · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2021-3827 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3827 · Note
• https://t.me/cvenotify/38796 · Telegram Post