CVE-2019-14837

2020-01-0716:33:21

CWE-547

redhat

raw.githubusercontent.com

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.6%

JSON

A flaw was found in keycloack before version 8.0.0. The owner of ‘placeholder.org’ domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name ‘test’ the email address will be ‘[email protected]’.