GitHub Advisoryadvisory · Maven

GHSA-c7xw-p58w-h6fj Keycloak: Impersonation and lockout possible through incorrect handling of email trust

MEDIUM Published 2023-07-18 Modified 2023-07-18 Official page ↗

Aliases: CVE-2023-0105
Ecosystem: Maven
Packages: org.keycloak:keycloak-core
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses: CWE-287, CWE-841
Reviewed: 2023-07-18

Affected packages

• Maven org.keycloak:keycloak-core: < 22.0.1 → fixed in 22.0.1

Description

Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them.

Alias · CVE (1)

CVE-2023-0105 A flaw was found in Keycloak. vulnerability

Weakness · CWE (2)

CWE-287 Improper Authentication weakness
CWE-841 Improper Enforcement of Behavioral Workflow weakness

References

https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj web
https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988 web
https://access.redhat.com/security/cve/CVE-2023-0105 web
https://bugzilla.redhat.com/show_bug.cgi?id=2158910 web
https://github.com/keycloak/keycloak package