CVE-2018-10894

Опубликовано: 01 авг. 2018

Источник: nvd

CVSS3: 5.4

CVSS2: 5.5

EPSS Низкий

Описание

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.

Ссылки

https://access.redhat.com/errata/RHSA-2018:3592
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0877
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10894
Issue Tracking
Patch
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3592
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3593
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3595
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0877
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10894
Issue Tracking
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:keycloak:3.4.3:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 17%

0.00054

Низкий

5.4 Medium

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-345

CWE-295

Связанные уязвимости

CVE-2018-10894

CVSS3: 5.4

redhat

около 7 лет назад

CVE-2018-10894

CVSS3: 5.4

debian

около 7 лет назад

It was found that SAML authentication in Keycloak 3.4.3.Final incorrec ...

GHSA-xvv8-8wh9-9fh2

CVSS3: 5.4

github

больше 3 лет назад

Keycloak Authentication Error

EPSS

Процентиль: 17%

0.00054

Низкий

5.4 Medium

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-345

CWE-295