GitHub Advisoryadvisory · Maven

GHSA-c9x9-xv66-xp3v Improper privilege management in Keycloak

HIGH Published 2021-11-10 Modified 2021-11-08 Official page ↗
Aliases
CVE-2020-14389
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-269, CWE-916
Reviewed
2021-11-08

Affected packages

• Maven org.keycloak:keycloak-core: < 12.0.0 → fixed in 12.0.0

Description

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission.

Related

Alias · CVE (1)

  • CVE-2020-14389 It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-916 Use of Password Hash With Insufficient Computational Effort weakness

References