Lucene search
Veracode Vulnerability DatabaseVERACODE:33546HistoryJan 07, 2022 - 6:42 a.m.
Authorization Bypass
2022-01-0706:42:42
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
13
keycloak
authorization bypass
user permissions
rest api
software
EPSS
0.005
Percentile
76.0%
keycloak-services is vulnerable to authorization bypass. The library does not properly validate the existing user permissions, allowing an authorized attacker to create new default user accounts via the administrative REST API.
References
bugzilla.redhat.com/show_bug.cgi?id=2033602
github.com/advisories/GHSA-83x4-9cwr-5487
github.com/ivangfr/keycloak-clustered/commit/abdc851c20b93b047bfaef7e83851915480f29a0
github.com/ivangfr/keycloak-clustered/pull/7
github.com/keycloak/keycloak/issues/9247
github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
www.oracle.com/security-alerts/cpuapr2022.html
Related
redhatcve
redhatcve
CVE-2021-4133
2021-12-17 12:49:59
github
github
Improper Authorization in Keycloak
2022-01-06 18:32:58
redhat
redhat
nessus
nessus
prion
prion
Design/Logic Flaw
2022-01-25 20:15:00
cve
cve
CVE-2021-4133
2022-01-25 20:15:08
ibm
ibm
nvd
nvd
CVE-2021-4133
2022-01-25 20:15:08
cnvd
cnvd
Keycloak Access Control Error Vulnerability (CNVD-2022-08727)
2021-12-21 00:00:00
osv
osv
Improper Authorization in Keycloak
2022-01-06 18:32:58
CVE-2021-4133
2022-01-25 20:15:08
cvelist
cvelist
CVE-2021-4133
2022-01-25 19:11:13