CVE-2019-10170
keycloak: script execution via realm management policy trigger
Severity Score
7.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.
Se encontró un fallo en la consola de administración de Keycloak, donde la interfaz de administración de un realm permite establecer un script por medio de la política. Este fallo permite a un atacante con permisos de usuario autenticado y administración del realm configurar un script malicioso para activar y ejecutar código arbitrario con los permisos del usuario de la aplicación.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-03-27 CVE Reserved
- 2020-05-08 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-267: Privilege Defined With Unsafe Actions
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10170 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2019-10170 | 2019-10-14 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1721295 | 2019-10-14 |