CVEvulnerability

CVE-2016-8629

6.5 MEDIUM Published 2018-03-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-03-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
Weaknesses
CWE-264, CWE-284

Description

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

Affected configurations

• redhat keycloak (< 2.4.0) • redhat single sign on 7.1 • redhat single sign on 7.2

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References