Описание
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.
Ссылки
- Issue TrackingVendor Advisory
- Permissions RequiredVendor Advisory
- Issue TrackingVendor Advisory
- Permissions RequiredVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 10.0.0 (исключая)
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
Конфигурация 2
cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
EPSS
Процентиль: 48%
0.00254
Низкий
5.3 Medium
CVSS3
5.9 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-297
CWE-295
Связанные уязвимости
CVSS3: 5.3
redhat
больше 5 лет назад
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.
CVSS3: 5.3
debian
больше 5 лет назад
A flaw was found in Keycloak in versions before 10.0.0, where it does ...
CVSS3: 5.9
github
почти 4 года назад
Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak
EPSS
Процентиль: 48%
0.00254
Низкий
5.3 Medium
CVSS3
5.9 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-297
CWE-295