GitHub Advisoryadvisory · Maven

GHSA-gf2j-7qwg-4f5x Improper Authentication in Keycloak

HIGH Published 2018-12-21 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-14637
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-285, CWE-287
Reviewed
2020-06-16

Affected packages

• Maven org.keycloak:keycloak-core: < 4.6.0 → fixed in 4.6.0

Description

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.

Related

Alias · CVE (1)

  • CVE-2018-14637 The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-287 Improper Authentication weakness

References