CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-3461 – keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP
https://notcve.org/view.php?id=CVE-2021-3461
A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name]. Se ha encontrado un fallo en keycloak por el que keycloak puede fallar al cerrar la sesión del usuario si la petición de cierre de sesión proviene de un proveedor de identidad SAML externo y el tipo de principal está configurado como atributo [nombre] • https://bugzilla.redhat.com/show_bug.cgi?id=1941565 https://access.redhat.com/security/cve/CVE-2021-3461 • CWE-613: Insufficient Session Expiration •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20202
https://notcve.org/view.php?id=CVE-2021-20202
A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity. Se ha encontrado un defecto en keycloak. Los Directorios pueden ser creados antes del proceso de Java que los crea en el directorio temporal, pero con permisos de usuario más amplios, permitiendo a un atacante tener acceso a los contenidos que keycloak almacena en este directorio. • https://bugzilla.redhat.com/show_bug.cgi?id=1922128 • CWE-377: Insecure Temporary File •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20222
https://notcve.org/view.php?id=CVE-2021-20222
A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en keycloak. La nueva consola de cuentas en keycloak puede permitir que sea ejecutado un código malicioso usando la URL de referencia. • https://bugzilla.redhat.com/show_bug.cgi?id=1924606 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20262
https://notcve.org/view.php?id=CVE-2021-20262
A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se encontró un fallo en Keycloak versión 12.0.0, donde no ocurre la re-autenticación mientras se actualiza la contraseña. Este fallo permite a un atacante apoderarse de una cuenta si puede obtener acceso físico temporal al navegador de un usuario. • https://bugzilla.redhat.com/show_bug.cgi?id=1933639 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.5EPSS: 11%CPEs: 2EXPL: 1CVE-2020-27838
https://notcve.org/view.php?id=CVE-2020-27838
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality. Se encontró un fallo en keycloak en versiones anteriores a 13.0.0. El endpoint de registro de clientes permite obtener información sobre clientes PÚBLICOS (como el secreto del cliente) sin autenticación, lo que podría ser un problema si el mismo cliente PÚBLICO cambiara a CONFIDENCIAL más adelante. • https://github.com/Cappricio-Securities/CVE-2020-27838 https://bugzilla.redhat.com/show_bug.cgi?id=1906797 • CWE-287: Improper Authentication •