GitHub Advisoryadvisory · Maven

GHSA-4gf2-xv97-63m2 Exposure of Sensitive Information in keycloak

MEDIUM Published 2021-09-20 Modified 2021-09-16 Official page ↗
Aliases
CVE-2020-1744
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-200, CWE-755
Reviewed
2021-09-16

Affected packages

• Maven org.keycloak:keycloak-core: < 9.0.1 → fixed in 9.0.1

Description

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.

Related

Alias · CVE (1)

  • CVE-2020-1744 A flaw was found in keycloak before version 9.0.1. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

References