GitHub Advisoryadvisory · Maven

GHSA-f32v-vf79-p29q Improper authorization in Keycloak

MEDIUM Published 2022-04-27 Modified 2022-05-26 Official page ↗
Aliases
CVE-2022-1466
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-863
Reviewed
2022-04-28

Affected packages

• Maven org.keycloak:keycloak-core: < 17.0.1 → fixed in 17.0.1

Description

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.

Related

Alias · CVE (1)

  • CVE-2022-1466 Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References