Keycloak
En bref
- Source
- NVD
- EPSS
- EPSS 1.37 % · centile 72 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
Faiblesses (CWE)
- CWE-863 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-83x4-9cwr-5487 — Improper Authorization in Keycloak
Références européennes
- ENISA EUVD · EUVD-2022-0514
- GCVE · GCVE-0-2021-4133
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*≥ 12.0.0 < 15.1.1
Produits affectés
| Produit | Versions |
|---|---|
| Keycloak | affected keycloak 15.1.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |