Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um falsche Informationen darzustellen und Sicherheitsvorkehrungen zu umgehen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 2
-
High 8.7CVE-2023-0264 Public exploit
Keycloak vulnerable to user impersonation via stolen UUID code
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and g…
-
Medium 6.1
keycloak-connect contains Open redirect vulnerability in the Node.js adapter
A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.
Revision history
-
#2
Neue Updates von HITACHI aufgenommen
-
#1
Initiale Fassung
References
-
Hitachi Vulnerability Information HITACHI-SEC-2023-143 vom 2023-10-03
https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-143/index.html
-
GitHub Advisory Database vom 2023-03-02
https://github.com/advisories/GHSA-9g98-5mj6-f9mv
-
GitHub Advisory Database vom 2023-03-02
https://github.com/advisories/GHSA-59fq-727j-hm3f