Summary
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Informationen offenzulegen.
Product
Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.
Vulnerabilities 1
-
High 8.8
Plaintext storage of user password
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and client…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-5q66-v53q-pm35 vom 2023-09-12
https://github.com/advisories/GHSA-5q66-v53q-pm35