CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1697 – keycloak: stored XSS in client settings via application links
https://notcve.org/view.php?id=CVE-2020-1697
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks. Se encontró en todas las versiones de keycloak anteriores a 9.0.0 que los enlaces de aplicaciones externas (Application Links) en la consola de administración no están validados apropiadamente y podrían permitir ataques de tipo XSS almacenado. Un usuario malicioso autorizado podría crear una URL para engañar a los usuarios en otras esferas y posiblemente conducir nuevos ataques. A flaw was found during the assessment of the Admin Console application for Keycloak, where it was found that Application Links to external applications are not validated properly. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697 https://access.redhat.com/security/cve/CVE-2020-1697 https://bugzilla.redhat.com/show_bug.cgi?id=1791538 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14910
https://notcve.org/view.php?id=CVE-2019-14910
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered. Se encontró una vulnerabilidad en keycloak versiones 7.x, cuando keycloak es configurado con LDAP user federation y StartTLS es usado en lugar de SSL/TLS desde el servidor LDAP (ldaps), en este caso la autenticación del usuario tiene éxito inclusive si una contraseña no válida se ha ingresado. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14910 • CWE-287: Improper Authentication CWE-295: Improper Certificate Validation CWE-305: Authentication Bypass by Primary Weakness CWE-592: DEPRECATED: Authentication Bypass Issues •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14909
https://notcve.org/view.php?id=CVE-2019-14909
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted. Se encontró una vulnerabilidad en Keycloak versiones 7.x donde un tipo de enlace de user federation LDAP es none (enlace anónimo LDAP), y será aceptada cualquier contraseña, no válida o válida. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909 • CWE-287: Improper Authentication CWE-305: Authentication Bypass by Primary Weakness CWE-592: DEPRECATED: Authentication Bypass Issues •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1CVE-2019-14837 – keycloak: keycloak uses hardcoded open dummy domain for new accounts enabling information disclosure
https://notcve.org/view.php?id=CVE-2019-14837
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'. Se encontró un fallo en keycloack versiones anteriores a la versión 8.0.0. El propietario del dominio "placeholder.org" puede configurar el servidor de correo sobre este dominio y conociendo solo el nombre de un cliente puede restablecer la contraseña y luego iniciar sesión. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14837 https://github.com/keycloak/keycloak/commit/9a7c1a91a59ab85e7f8889a505be04a71580777f https://issues.jboss.org/browse/KEYCLOAK-10780 https://access.redhat.com/security/cve/CVE-2019-14837 https://bugzilla.redhat.com/show_bug.cgi?id=1730227 • CWE-547: Use of Hard-coded, Security-relevant Constants CWE-798: Use of Hard-coded Credentials •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14820 – keycloak: adapter endpoints are exposed via arbitrary URLs
https://notcve.org/view.php?id=CVE-2019-14820
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information. Se descubrió que keycloak versiones anteriores la versión 8.0.0, expone los endpoints del adaptador interno en org.keycloak.constants.AdapterConstants, que pueden ser invocadas por medio de una URL especialmente diseñada. Esta vulnerabilidad podría permitir a un atacante acceder a información no autorizada. It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820 https://access.redhat.com/security/cve/CVE-2019-14820 https://bugzilla.redhat.com/show_bug.cgi?id=1649870 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •