Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-9g98-5mj6-f9mv

Опубликовано: 02 мар. 2023
Источник: github
Github: Прошло ревью
CVSS3: 8.7

Описание

Keycloak vulnerable to user impersonation via stolen UUID code

Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.

Пакеты

Наименование

org.keycloak:keycloak-services

maven
Затронутые версииВерсия исправления

< 21.0.1

21.0.1

EPSS

Процентиль: 88%
0.03942
Низкий

8.7 High

CVSS3

Дефекты

CWE-287
CWE-345

Связанные уязвимости

CVSS3: 4.6
redhat
почти 3 года назад

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

CVSS3: 5
nvd
больше 2 лет назад

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

CVSS3: 5
debian
больше 2 лет назад

A flaw was found in Keycloaks OpenID Connect user authentication, whic ...

CVSS3: 7.1
fstec
почти 3 года назад

Уязвимость службы OpenID Connect Login программного средства для управления идентификацией и доступом Keycloak, позволяющая нарушителю создать новые токены сеанса и оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 88%
0.03942
Низкий

8.7 High

CVSS3

Дефекты

CWE-287
CWE-345