CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-1724 – keycloak: problem with privacy after user logout
https://notcve.org/view.php?id=CVE-2020-1724
11 May 2020 — A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section. Se encontró un fallo en Keycloak en versiones anteriores a 9.0.2. Este fallo permite a un usuario malicioso que actualmente está registrado, visualizar la información personal de un usuario que previamente a cerrado sesión en la sección del administrador de la cuenta. A flaw was found in Keycloak.... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1724 • CWE-613: Insufficient Session Expiration •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1698 – keycloak: Password leak by logged exception in HttpMethod class
https://notcve.org/view.php?id=CVE-2020-1698
11 May 2020 — A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality. Se detectó un fallo en keycloak en versiones anteriores a 9.0.0. Una excepción registrada en la clase HttpMethod puede filtrar la contraseña dada como parámetro. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10686
https://notcve.org/view.php?id=CVE-2020-10686
04 May 2020 — A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users. Se encontró un fallo en Keycloak versión 8.0.2 y 9.0.0, y se corrigió en Keycloak versión 9.0.1, donde un usuario malicioso se registra como uno mismo. El atacante podría luego usar el formulario de eliminar dispositivos para publicar dif... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10686 • CWE-285: Improper Authorization •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1728 – keycloak: security headers missing on REST endpoints
https://notcve.org/view.php?id=CVE-2020-1728
06 Apr 2020 — A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors. Se detectó una vulnerabilidad en todas las versiones de Keyclo... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1728 • CWE-358: Improperly Implemented Security Check for Standard CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-1744 – keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP
https://notcve.org/view.php?id=CVE-2020-1744
24 Mar 2020 — A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events. Se descubrió un fallo en keycloak versiones anteriores a la versión 9.0.1. Cuando se configura un Conditional OTP Authentication Flow como un flujo posterior al inicio de sesión de un IDP, los eventos de inicio de sesión falli... • https://access.redhat.com/security/cve/CVE-2020-1744 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1697 – keycloak: stored XSS in client settings via application links
https://notcve.org/view.php?id=CVE-2020-1697
10 Feb 2020 — It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks. Se encontró en todas las versiones de keycloak anteriores a 9.0.0 que los enlaces de aplicaciones externas (Application Links) en la consola de administración no están validados apropiadamente y podrían permi... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •