GitHub Advisoryadvisory · Maven

GHSA-778x-2mqv-w6xw Moderate severity vulnerability that affects org.keycloak:keycloak-core

MEDIUM Published 2018-10-18 Modified 2020-06-16 Official page ↗
Aliases
CVE-2016-8629
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2020-06-16

Affected packages

• Maven org.keycloak:keycloak-core: < 2.4.0 → fixed in 2.4.0

Description

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

Related

Alias · CVE (1)

  • CVE-2016-8629 Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References