GitHub Advisoryadvisory · Maven

GHSA-85v8-vx4w-q684 Keycloak Improper Bruteforce Detection

HIGH Published 2022-05-13 Modified 2023-10-05 Official page ↗
Aliases
CVE-2018-14657
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-307
Reviewed
2023-07-20

Affected packages

• Maven org.keycloak:keycloak-parent: < 4.6.0.Final → fixed in 4.6.0.Final

Description

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

Related

Alias · CVE (1)

  • CVE-2018-14657 A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References