Lucene search

RedhatCVE-2018-14657

HistoryNov 13, 2018 - 7:29 p.m.

CVE-2018-14657

2018-11-1319:29:00

CWE-307

redhat

web.nvd.nist.gov

keycloak

4.2.1.final

4.3.0.final

topt

brute force detection

implementation

vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

62.4%

JSON

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

Affected configurations

Nvd

Vulners

Node

redhatkeycloakMatch4.2.1

redhatkeycloakMatch4.3.0

Node

redhatsingle_sign-onMatch7.2

AND

redhatlinuxMatch7.0

Node

redhatsingle_sign-onMatch7.2

AND

redhatlinuxMatch6.0

Node

redhatsingle_sign-onMatch-text-only

VendorProductVersionCPE
redhatkeycloak4.2.1cpe:2.3:a:redhat:keycloak:4.2.1:*:*:*:*:*:*:*
redhatkeycloak4.3.0cpe:2.3:a:redhat:keycloak:4.3.0:*:*:*:*:*:*:*
redhatsingle_sign-on7.2cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*
redhatlinux7.0cpe:2.3:o:redhat:linux:7.0:*:*:*:*:*:*:*
redhatlinux6.0cpe:2.3:o:redhat:linux:6.0:*:*:*:*:*:*:*
redhatsingle_sign-on-cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*

Vendor	Product	Version	CPE
redhat	keycloak	4.2.1	cpe:2.3:a:redhat:keycloak:4.2.1:::::::*
redhat	keycloak	4.3.0	cpe:2.3:a:redhat:keycloak:4.3.0:::::::*
redhat	single_sign-on	7.2	cpe:2.3:a:redhat:single_sign-on:7.2:::::::*
redhat	linux	7.0	cpe:2.3:o:redhat:linux:7.0:::::::*
redhat	linux	6.0	cpe:2.3:o:redhat:linux:6.0:::::::*
redhat	single_sign-on	-	cpe:2.3:a:redhat:single_sign-on:-::::text-only:::

CNA Affected

[
  {
    "product": "keycloak",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "4.2.1.Final, 4.3.0.Final"
      }
    ]
  }
]