PT-2023-16014 · Red Hat · Keycloak

Willem Noort · Published 2023-01-11 · Updated 2023-07-18 · CVE-2023-0105

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in Keycloak allows impersonation and lockout due to incorrect handling of email trust. This issue enables an attacker to shadow other users with the same email, potentially leading to lockout or impersonation. The problem arises because the verified state of an email is not reset when the email changes, allowing users to shadow others with the same email.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-841

CWE-287

Related Identifiers

CVE-2023-0105

GHSA-C7XW-P58W-H6FJ

GHSA-VHVQ-JH34-3FC8

RHSA-2023:7482

RHSA-2023:7483

RHSA-2023:7484

Affected Products

Keycloak

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-0105 · Security Note
• https://osv.dev/vulnerability/GHSA-vhvq-jh34-3fc8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c7xw-p58w-h6fj · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-0105 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0105 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj · Note
• https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0105 · Note
• https://t.me/cvenotify/42674 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2158910 · Note