CVE-2020-10686

2020-05-0420:05:37

CWE-285

redhat

www.cve.org

4.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.5%

JSON

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.

CNA Affected

[
  {
    "product": "keycloak",
    "vendor": "Keycloak",
    "versions": [
      {
        "status": "affected",
        "version": "8.0.2"
      },
      {
        "status": "affected",
        "version": "9.0.0"
      }
    ]
  }
]