Описание
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
Ссылки
- ExploitIssue TrackingVendor Advisory
- PatchThird Party Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- ExploitIssue TrackingVendor Advisory
- PatchThird Party Advisory
- Issue TrackingPermissions RequiredVendor Advisory
Уязвимые конфигурации
EPSS
9.1 Critical
CVSS3
9.1 Critical
CVSS3
6.4 Medium
CVSS2
Дефекты
Связанные уязвимости
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
A flaw was found in keycloack before version 8.0.0. The owner of 'plac ...
keycloak vulnerable to unauthorized login via mail server setup
Уязвимость программного средства для управления идентификацией и доступом Keycloak, связанная с использованием предустановленных регистрационных данных, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
9.1 Critical
CVSS3
9.1 Critical
CVSS3
6.4 Medium
CVSS2