GitHub Advisoryadvisory · Maven

GHSA-p225-pc2x-4jpm Incorrect Authorization in keycloak

MEDIUM Published 2022-02-09 Modified 2021-04-01 Official page ↗
Aliases
CVE-2020-1725
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-668, CWE-863
Reviewed
2021-04-01

Affected packages

• Maven org.keycloak:keycloak-parent: < 13.0.0 → fixed in 13.0.0

Description

A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token.

Related

Alias · CVE (1)

  • CVE-2020-1725 A flaw was found in keycloak before version 13.0.0. vulnerability

Weakness · CWE (2)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness
  • CWE-863 Incorrect Authorization weakness

References