GitHub Advisoryadvisory · Maven

GHSA-fv4q-wm8c-wjg4 Keycloak Authentication Error

HIGH Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-14909
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-287, CWE-305
Reviewed
2023-07-18

Affected packages

• Maven org.keycloak:keycloak-parent: >= 7.0.0, <= 7.0.1 (no fix yet)

Description

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

Related

Alias · CVE (1)

  • CVE-2019-14909 A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-305 Authentication Bypass by Primary Weakness weakness

References