Lucene search

Veracode Vulnerability DatabaseVERACODE:30589

HistoryMay 21, 2021 - 1:47 p.m.

User Impersonation

2021-05-2113:47:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

keycloak is vulnerable to user impersonation. A Internationalized domain name (IDN) homograph attack allows an attacker to impersonate a user.

CPENameOperatorVersion
rh-sso7-keycloakeq3.4.8__2.Final_redhat_6.1.jbcs.el7
rh-sso7-keycloakeq2.5.7__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloakeq3.4.12__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloakeq2.5.10__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq2.5.5__2.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloakeq3.4.3__1.Final_redhat_2.1.jbcs.el6
rh-sso7-keycloakeq3.4.3__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloakeq3.4.12__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloakeq2.5.7__1.Final_redhat_2.1.jbcs.el6
rh-sso7-keycloakeq3.4.10__1.Final_redhat_1.1.jbcs.el7

Name	Operator	Version
rh-sso7-keycloak	eq	3.4.8__2.Final_redhat_6.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.7__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloak	eq	3.4.12__1.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloak	eq	2.5.10__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.5__2.Final_redhat_1.1.jbcs.el6
rh-sso7-keycloak	eq	3.4.3__1.Final_redhat_2.1.jbcs.el6
rh-sso7-keycloak	eq	3.4.3__1.Final_redhat_2.1.jbcs.el7
rh-sso7-keycloak	eq	3.4.12__1.Final_redhat_1.1.jbcs.el7
rh-sso7-keycloak	eq	2.5.7__1.Final_redhat_2.1.jbcs.el6
rh-sso7-keycloak	eq	3.4.10__1.Final_redhat_1.1.jbcs.el7

Rows per page:

1-10 of 481

References

access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/html/release_notes/index

access.redhat.com/errata/RHSA-2021:2064

access.redhat.com/security/updates/classification/#moderate

bugzilla.redhat.com/show_bug.cgi?id=1933320

github.com/advisories/GHSA-mwm4-5qwr-g9pf

github.com/keycloak/keycloak/commit/ac79fd0c23c6947a04073afc61e30d341498438e

github.com/keycloak/keycloak/issues/11532

github.com/keycloak/keycloak/pull/11531

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

Related for VERACODE:30589