Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2020-14302

Опубликовано: 26 нояб. 2020
Источник: redhat
CVSS3: 3.5
EPSS Низкий

Описание

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

A flaw was found in Keycloak, where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Decision Manager 7keycloakNot affected
Red Hat Fuse 7keycloakNot affected
Red Hat OpenShift Application RuntimeskeycloakNot affected
Red Hat Process Automation 7keycloakNot affected
Red Hat support for Spring BootkeycloakNot affected
Red Hat Single Sign-On 7.4.6FixedRHSA-2021:097423.03.2021
Red Hat Single Sign-On 7.4 for RHEL 6rh-sso7-keycloakFixedRHSA-2021:096723.03.2021
Red Hat Single Sign-On 7.4 for RHEL 7rh-sso7-keycloakFixedRHSA-2021:096823.03.2021
Red Hat Single Sign-On 7.4 for RHEL 8rh-sso7-keycloakFixedRHSA-2021:096923.03.2021

Показывать по

Дополнительная информация

Статус:

Low
Дефект:
CWE-294
https://bugzilla.redhat.com/show_bug.cgi?id=1849584keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks

EPSS

Процентиль: 36%
0.00154
Низкий

3.5 Low

CVSS3

Связанные уязвимости

CVSS3: 4.9
nvd
около 5 лет назад

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

CVSS3: 4.9
debian
около 5 лет назад

A flaw was found in Keycloak before 13.0.0 where an external identity ...

CVSS3: 4.9
github
больше 3 лет назад

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

EPSS

Процентиль: 36%
0.00154
Низкий

3.5 Low

CVSS3